> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://projectfusion.crisp.help/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# safedrop Administrator Guide

# safedrop Tenant Administrator Guide
This guide covers administrative tasks for managing your organisation's safedrop instance.

## Overview
As a Tenant Administrator, you have access to manage:
* Teams and team memberships
* Users and access permissions
* Organisation settings
* Security configurations
* Audit logs.

### Must-do setup checklist
Complete and record this checklist during initial setup. Revisit it after material organisational, legal, or security-policy changes.
▢ **Configure** [**domain access control**](#security-settings)**.** Restricting registration to approved email domains reduces unauthorised signups; document any domains that must remain open and why.
▢  **Require** [**two-factor authentication**](#security-settings)**.** Organisation-wide 2FA reduces the risk that a stolen password becomes an account or administrative compromise.
▢  **Review and configure** [**sending before TEK approval**](#what-tek-approval-gates)**.** Allowing it improves onboarding speed, but messages sent before approval are not admin-recoverable until their team-key wrap is backfilled.
Keeping it disabled delays sending until an administrator grants access. **We recommend allow sending.**

▢ **Audit Logging** - we recommend you choose **Log personally identifiable information in audit events** Including names or other personal data can improve investigations but increases privacy exposure and compliance obligations; excluding it can reduce investigative context. 
▢ **Set** [**audit-log retention**](#audit-privacy-and-retention)**.** Keep events long enough for investigations and compliance without retaining personal or security data longer than policy permits.
▢ **Set** [**max message expiry**](#message-settings)**.** A shorter period reduces retained sensitive data; a longer period supports operational and records-management needs. Teams can override with a *lower* value, they can not go higher.
▢ **Assign** [**administrator cover**](#administrator-resilience-and-emergency-access)**.** Wherever possible, maintain at least two active, individually assigned tenant administrators and at least two suitable administrators on every team
▢ **Establish and govern** [**emergency cover**](#administrator-resilience-and-emergency-access)**.** Prefer an organisation-controlled break-glass account; if using the optional safedrop -managed arrangement, enrol it from the outset and agree its minimum standing access before an incident.

## Accessing the Admin Panel
1. Log in with your administrator account
2. Click **Admin** in the main menu
3. You'll see the administration dashboard

![](https://storage.crisp.chat/users/helpdesk/website/-/2/e/0/9/2e09850730579800/image_1d27isb.png =900x600)


*Screenshot: The main administration dashboard*
## Team Management
### ➕ Creating Teams
1. Navigate to **Teams** from the menu
2. Click **New Team**
3. Enter a team name and description
4. Click **Create Encrypted Team**
A Team Encryption Key (TEK) is automatically generated. You'll be the first member with access.
Assign at least one additional tenant admin wherever possible. Two named administrators should be available for routine membership and TEK approvals so absence, account loss, or offboarding of one person does not halt administration.

![](https://storage.crisp.chat/users/helpdesk/website/-/2/e/0/9/2e09850730579800/image_lf3kyy.png =900x600)

*Screenshot: The create team dialog*


### Setting the Default Team
One team should be marked as default for new user signups:
1. Go to **Teams**
2. Click the menu on the team
3. Select **Set as Default**
New self-signup users are automatically added to the default team.


### Deleting Teams
1. Click the menu on the team
2. Select **Delete Team**
3. Type the team name to confirm
4. Click **Delete**
**Note:** You cannot delete the default team. Set another team as default first.


## Member Management
### Adding Members
1. Select a team
2. Click **Add Member**
3. Enter the user's email address
4. Select their role (Member or Admin)
5. Click **Add**
If the user doesn't exist, an invitation needs to first be sent to their email from the Admin panel.
![](https://storage.crisp.chat/users/helpdesk/website/-/2/e/0/9/2e09850730579800/image_1pqrlej.png =900x600)
*Screenshot: The add member dialog*


### Roles Explained
| Role | Capabilities |
| ---- | ---- |
| **Member** | View and upload files, access messages |
| **Admin** | Everything members can do, plus: invite users, grant team access, manage team settings |

A tenant administrator can manage organisation-wide settings, but that authority does not automatically mean they are a team administrator or hold a team's encryption key. Team membership, the team administrator role, and team encryption access must each be granted deliberately.


### Granting TEK (team encryption key) Access
When new members join, they need TEK access to view encrypted content:
1. You'll see a notification banner when users are waiting
2. Go to **Teams** and select the team
3. Find the member with "Pending Access" badge
4. Click **Grant Access**
The member's public key is used to wrap the TEK, giving them access.
![](https://storage.crisp.chat/users/helpdesk/website/-/2/e/0/9/2e09850730579800/image_100dyh8.png =900x600)![](https://storage.crisp.chat/users/helpdesk/website/-/2/e/0/9/2e09850730579800/screenshot-2026-09-22-091353_vfrvsb.png =900x600)
*Screenshot: The pending access banner and grant access button*

### What TEK Approval Gates
TEK approval controls access to **team content** — the team vault, shared folders, and team recipients. Whether it also gates *sending* safedrops is your choice:
* **Default:** members cannot send safedrop until you grant them TEK access.
* **Optional:** turn on **"Allow members to send before TEK approval"** (Organization Settings → Security Policy) to let new members send immediately. Their messages are delivered normally; once you grant TEK access, their browser automatically backfills the team-key wrap on those messages so they become admin-recoverable like any other. Changing this toggle is recorded in the audit log.
While a member is pending, vault-dependent actions (Send from Vault, team recipients, team folders) stay disabled with an "awaiting admin approval" hint.

### Viewing Member safedrops (Admin)
As a team admin with TEK access, you can open a safedrop sent by a member of your team and read its content. Because you're not a recipient, the viewer first shows an explicit **"View as team admin"** button — nothing is decrypted until you click it. Decryption then happens entirely in your browser using your wrapped team key, so the server never sees the plaintext, and the viewer shows a clear **"Viewing as team admin"** banner.

Accountability and limits:
* **Every admin view is audit-logged** (who accessed which message's keys, and when). Any retrieval of a message file's keys by someone who is not the sender or a recipient is recorded, so member privacy is accountable.
* **Team boundary model:** the team is the trust boundary — technically, any team member holding the TEK could retrieve a sent message's wrapped keys via the API (the UI only surfaces viewing to admins, and all such access is audited). Users who need privacy from teammates or admins should use their own single-member team.
* Messages sent **before** TEK approval (and not yet backfilled) have no team-key wrap, so admins cannot read them; the viewer explains why.
* You cannot view messages from teams where you are not an admin with TEK access.

### Removing Members
1. Select the team
2. Find the member
3. Click the menu on their row
4. Select **Remove from Team**
5. Confirm the removal
**Note:** Removed members lose access immediately. They cannot decrypt any team content.
Before removing a team administrator, verify that another suitable team administrator is active and has the access needed for routine work. For a departing tenant administrator, follow the [administrator offboarding](#administrator-offboarding) steps.

## 👥 User Management
### Viewing All Users
1. Go to **Admin** → **Users** tab
2. View all users in your organisation
3. See their status, role, and verification state

*Screenshot: The user management table*

### User Status Indicators
| Status | Meaning |
| ---- | ---- |
| **Active** | User can access the platform |
| **Pending** | Waiting for email verification |
| **Locked** | Account temporarily locked |
| **Deleted** | Account marked for deletion |

### Resetting User 2FA
If a user loses access to their authenticator:
1. Find the user in the list
2. Click the menu
3. Select **Reset 2FA**
4. Confirm the action
The user will need to set up 2FA again at next login.

### Deleting Users
1. Find the user
2. Click the menu
3. Select **Delete User**
4. Confirm deletion

**Warning:** This removes the user from all teams and revokes all access.


## ⚙️ Organisation Settings


### Accessing Settings
1. Go to **Admin** → **Settings** tab
2. Configure organisation-wide options

### Branding
| Setting | Description |
| ---- | ---- |
| **Logo** | Upload your organisation's logo |


### Security Settings
| Setting | Required setup decision and consequence |
| ---- | ---- |
| **Allowed Domains** | Configure the approved email domains for registration. People with emails in these domains can sign themselves up to use your safedrop. |
| **Session Timeout** | Choose how quickly inactive sessions end. Shorter timeouts reduce unattended-session risk but may interrupt work. |
| **2FA Required** | Enable this organisation-wide. 2FA materially reduces password-only account takeover, especially for administrators. |
| **Allow members to send before TEK approval** | Review and configure this as a risk-based choice. Enabling it speeds onboarding, but pre-approval messages remain outside team-admin recovery until the team-key wrap is backfilled. Disabling it requires an administrator to approve TEK access before sending. |
| **Log PII in audit events** | Review and configure this as a privacy and investigation decision, not a universal recommendation. PII can make investigations clearer, but increases the sensitivity and compliance burden of the audit log. We recommend logging it - it's only file names and recipient email addresses - NOT CONTENTS! |

### Embedding Settings
Control how safedrop forms can be embedded:
| Setting | Description |
| ---- | ---- |
| **Enable Embedding** | Allow forms to be embedded on external sites |
| **Allowed Domains** | Whitelist specific domains for embedding |
| **Custom CSP** | Advanced content security policy settings |

### Message Settings
| Setting | Required setup decision and consequence |
| ---- | ---- |
| **Default Expiry** | Set the normal number of days before messages expire. Short retention reduces exposure and data-minimisation risk; longer retention may be needed for operations or records policy. |
| **Max Expiry** | Limit how far senders may extend expiry so individual choices cannot exceed organisation policy. |
| **Delete on Expiry** | Decide whether expired messages are deleted or archived according to your recovery, legal-hold, and data-minimisation requirements |

## Storage Management

### 📊 Viewing Storage Usage
1. Go to **Admin** → **Storage** tab
2. See total storage used
3. View breakdown by team


### 📦 Storage Limits
Your plan includes a storage allocation. When approaching limits:
* Users receive warnings when uploading
* Uploads are blocked when limit is reached
* Contact your safedrop account manager to increase limits

## 📝 Audit Logs

### 🔎 Viewing Audit Logs
1. Go to **Admin** → **Audit Logs** tab
2. Browse security-relevant events
3. Filter by user, action, or date range


### 📋 Events Logged
| Event Type | Description |
| ---- | ---- |
| **Login** | User sign-ins (success and failure) |
| **Logout** | User sign-outs |
| **User Created** | New user registrations |
| **Team Created** | New team creation |
| **Member Added** | User added to team |
| **Member Removed** | User removed from team |
| **TEK Granted** | Encryption access granted |
| **File Uploaded** | File added to Secure Store |
| **File Downloaded** | File downloaded from Secure Store |
| **Message Sent** | safedrop message created |
| **Message Viewed** | Message opened by recipient |


### Audit Privacy and Retention
Configure both settings during setup:
1. **Review whether audit events may include personally identifiable information.** Enabling PII can provide names and other context useful for attribution and investigations. It also makes the log more sensitive, increases the impact of unauthorised access or export, and may create additional privacy, disclosure, and deletion obligations. Disabling it reduces that exposure but can make investigations less direct. Record the risk-based choice and who approved it.
2. **Set the audit-log retention period.** Base it on investigation needs, regulatory or contractual requirements, and data-minimisation policy. A short period may remove evidence before an incident is discovered; a long or permanent period increases the amount of personal and security data exposed and may conflict with retention obligations.
Limit access to audit logs and exports, monitor administrator and emergency-account activity, and review these settings periodically.

### Exporting Logs
1. Filter to your desired date range
2. Click **Export**
3. Download CSV file


## 🛡️ Security Administration

### Key Rotation
Rotate team encryption keys for security:
1. Go to **Teams**
2. Select the team
3. Click **Security** tab
4. Click **Rotate Keys**
All team members receive new wrapped keys. Files are re-encrypted with the new key.
**Note:** Key rotation may take time for teams with many files.

### Account Recovery
When users cannot access their accounts:
**Tier 1 Recovery (Self-Service):**
* User uses their 12-word recovery phrase
* No admin intervention needed
**Tier 2 Recovery (Admin Assisted):**
* User requests admin recovery
* Admin verifies identity out-of-band
* Admin initiates account reset
* User creates new credentials

|||
User recovery does not replace administrator continuity planning. If the only available administrator cannot sign in, use the organisation's pre-established emergency-access arrangement; do not create or enrol an unplanned third-party account during the incident.



### Monitoring Failed Logins
1. Check audit logs for failed login attempts
2. Look for patterns indicating attacks
3. Consider temporarily locking affected accounts

## Best Practices for  Administrator Resilience and Emergency Access :

#### Day-to-day administrator cover
Named day-to-day administrators are the primary protection against absence and offboarding risk:
* Wherever possible, maintain at least **two active, individually assigned tenant administrators**. Each should use their own account and MFA so actions remain attributable.
* Maintain at least **two appropriate tenant administrators on each team** wherever possible. Confirm both can perform the membership and TEK-approval work expected of them. (Team admins are planned, but not here yet)
* Review administrator assignments regularly and before planned leave or offboarding. Emergency access supplements this redundancy; it should not replace it.

#### Preferred model: organisation-controlled break-glass account
The preferred emergency model is a dedicated, non-personal account controlled by your organisation. Establish it during setup so it is ready if all normal tenant administrators are unavailable. Do not use it for routine work or assign it to an individual employee.
Grant only the access required by the documented recovery objective, we suggest:
* create an account like admin@acme.com and add as a tenant admin
  * carefully note password, 2fa details (set string and or QR code) and passphrase. save these somewhere REALLY SAFE
* every time you add a new team, add that account to the team
* test this account periodically



#### 🆘 Optional model: safedrop-managed emergency cover
An organisation may opt into a dedicated emergency user controlled by safedrop support. This must be configured as **standing emergency cover from day one**, with access and activation governance agreed in advance; it is not an account first created during an incident.
To begin the setup process, email support@safedrop.com. The email is a request to agree and configure the arrangement. It does **not**, by itself, authorise safedrop to access the tenant or activate the emergency user.
A permanently enrolled third-party user weakens the organisation-only security boundary: the account and its standing permissions remain an additional path into the tenant even while dormant. Decide separately whether it receives:
1. tenant-administrator authority;
2. administrator membership in specified teams; and
3. TEK access for specified teams.
Grant only the standing access the organisation has deliberately accepted and documented. Treat TEK access, and therefore potential encrypted-content access, as a separate and substantially higher-risk decision. Support-controlled emergency cover intended only to restore tenant administration should not also receive team or TEK access.


#### Governance for either emergency model
Document and operate the arrangement:
* protect credentials and MFA factors separately using organisation-approved controls; do not share them with routine administrators;
* define who may authorise activation, how their identity is verified, and the actions permitted;
* monitor audit events for enrolment, permission changes, sign-in, and use of the emergency account;
* periodically review its owner, permissions, team memberships, TEK access, and continued need;
* test access at an agreed interval without reading encrypted content unless that test is specifically authorised;
* notify the customer organisation when an emergency account is activated or used;
* after use, review actions and audit records, rotate or reset credentials and MFA as appropriate, and remove any temporary access;
* remove the account, memberships, and access when the arrangement is no longer required.
For the safedrop -managed option, capture the agreed activation, notification, review, and termination process during setup rather than assuming support terms that have not been agreed.

### Team Structure
1. **Create logical teams** - Based on departments or projects
2. **Limit admin roles** - Only grant admin where needed
3. **Maintain team-admin cover** - Assign at least two suitable administrators per team wherever possible
4. **Review memberships regularly** - Remove inactive members
5. **Use meaningful names** - Make team purposes clear

### Security
1. **Require 2FA** - Enable organisation-wide 2FA requirement
2. **Complete the setup checklist** - Record every required configuration and risk decision
3. **Monitor audit logs** - Check regularly for unusual and emergency-account activity
4. **Prompt TEK approvals** - Don't leave users waiting
5. **Rotate keys annually** - Maintain encryption hygiene

### User Management
1. **Verify identities** - Before granting access or recovery
2. **Offboard promptly** - Remove departed employees immediately
3. **Document roles** - Keep records of who has admin access
4. **Train users** - Ensure users understand security features

### Administrator Offboarding
Before deactivating or deleting an administrator:
1. Confirm another active tenant administrator will remain; wherever possible, restore the recommended minimum of two.
2. For every affected team, confirm at least two suitable team administrators remain where possible and that the required TEK approvals are complete.
3. Transfer operational records and ownership of periodic access reviews.
4. Remove the departing person's tenant role, team memberships, and access promptly.
5. Review audit events for unexpected recent changes.
6. If the person had custody of emergency credentials or MFA, replace those credentials and review the emergency arrangement.


## 🔧 Troubleshooting

### User Cannot Access Team
1. Check they're added as a team member
2. Verify their TEK access has been granted
3. Have them try logging out and back in
4. Check they've verified their email
### No Day-to-Day Administrator Is Available
1. Do not create an ad hoc shared or third-party administrator account.
2. Use the organisation's pre-established break-glass account or agreed safedrop -managed emergency user.
3. Follow the documented activation-authorisation and identity-verification process.
4. Grant no additional team or TEK access unless it is necessary and specifically authorised.
5. Monitor and record the activity, notify the organisation when the account is used, and complete the post-use review.
6. After service is restored, re-establish at least two active named tenant administrators and appropriate team-admin cover.

### 💾 Storage Limit Issues
1. Review storage usage by team
2. Identify large files that can be removed
3. Contact safedrop for limit increases

### 🔎 Audit Log Missing Events
1. Ensure you're looking at correct date range
2. Check event type filters
3. Some events may be delayed slightly

## 🆘 Getting Help
For issues beyond this guide:
* **Technical Support** - Contact safedrop support
* **safedrop-managed emergency-cover setup** - Email support@safedrop.com to begin an agreed setup process; email alone does not authorise tenant access
* **Account Changes** - Contact your account manager
* **Security Incidents** - Report immediately to safedrop security team