IT documentation and credentials

Documentation holds what your team knows about each client's environment: documents, runbooks, networks, licences and the credentials you manage for them. Client administrators see a read-only view of their own records in the portal.

Documents and runbooks

• Documents are files and written pages per client, in folders, with version history and comments. Document templates give recurring documents a standard shape.
• Runbooks are step-by-step procedures stored beside the client record.

A runbook earns its place when a task is done more than twice, when only one person knows how to do it, or when it is a recovery procedure. Give each one this shape:

1. Purpose: what it achieves and when to use it.
2. Prerequisites: access, credentials by name, tools, downtime window.
3. Steps: numbered and exact, with the expected result at each stage.
4. Verification: how you know it worked.
5. Rollback: how to undo it.
6. Owner and review date.

The editor supports headings, lists, links, code, images and Markdown.

Networks, licences and other records

Each client can also hold network records (site layout, address ranges, internet services), software licences with seat counts and renewal dates, domains and rack layouts. Clients see their assets, licences and networks in the portal.

Client credentials

Client credentials are the admin logins you manage for a client: firewalls, routers, hosting, domain registrars.

• They are encrypted at rest and shown only when someone clicks Reveal.
• Revealing a secret needs the Documentation · Reveal secrets permission.
• Every reveal is logged with who and when.
• A credential can hold a two-factor secret. Copy 2FA code gives the current code without showing the secret.

The rules for your team:

• Reveal only with a live reason: an open ticket or a job you are doing now.
• Never paste a secret into a ticket, chat, email, note or AI prompt. Refer to it by name.
• Rotate a credential straight away after any exposure, and say so on the ticket.

Rotation and access reviews

Credentials can carry a rotation interval. A daily check flags the ones that are due. Once a month the app opens an access review that shows which staff opened which client secrets. That review needs the Security permission, so technicians cannot study each other's activity.

The password vault

The password vault is shared password storage for your clients' own teams. Client users store, share and copy their passwords from the portal. Items are encrypted at rest with AES-256-GCM, using a dedicated vault key when one is set.

Opening a vault item from the staff side needs the Passwords permissions. Clients' personal items are a separate permission again.