safedrop Tenant Administrator Guide

This guide covers administrative tasks for managing your organisation's safedrop instance.

Overview

As a Tenant Administrator, you have access to manage:

• Teams and team memberships
• Users and access permissions
• Organisation settings
• Security configurations
• Audit logs.

Must-do setup checklist

Complete and record this checklist during initial setup. Revisit it after material organisational, legal, or security-policy changes.
▢ Configure domain access control. Restricting registration to approved email domains reduces unauthorised signups; document any domains that must remain open and why.
▢ Require two-factor authentication. Organisation-wide 2FA reduces the risk that a stolen password becomes an account or administrative compromise.
▢ Review and configure sending before TEK approval. Allowing it improves onboarding speed, but messages sent before approval are not admin-recoverable until their team-key wrap is backfilled.
Keeping it disabled delays sending until an administrator grants access. We recommend allow sending.

▢ Audit Logging - we recommend you choose Log personally identifiable information in audit events Including names or other personal data can improve investigations but increases privacy exposure and compliance obligations; excluding it can reduce investigative context.
▢ Set audit-log retention. Keep events long enough for investigations and compliance without retaining personal or security data longer than policy permits.
▢ Set max message expiry. A shorter period reduces retained sensitive data; a longer period supports operational and records-management needs. Teams can override with a lower value, they can not go higher.
▢ Assign administrator cover. Wherever possible, maintain at least two active, individually assigned tenant administrators and at least two suitable administrators on every team
▢ Establish and govern emergency cover. Prefer an organisation-controlled break-glass account; if using the optional safedrop -managed arrangement, enrol it from the outset and agree its minimum standing access before an incident.

Accessing the Admin Panel

1. Log in with your administrator account
2. Click Admin in the main menu
3. You'll see the administration dashboard

Screenshot: The main administration dashboard

Team Management

➕ Creating Teams

1. Navigate to Teams from the menu
2. Click New Team
3. Enter a team name and description
4. Click Create Encrypted Team

A Team Encryption Key (TEK) is automatically generated. You'll be the first member with access.
Assign at least one additional tenant admin wherever possible. Two named administrators should be available for routine membership and TEK approvals so absence, account loss, or offboarding of one person does not halt administration.

Screenshot: The create team dialog

Setting the Default Team

One team should be marked as default for new user signups:

1. Go to Teams
2. Click the menu on the team
3. Select Set as Default

New self-signup users are automatically added to the default team.

Deleting Teams

1. Click the menu on the team
2. Select Delete Team
3. Type the team name to confirm
4. Click Delete

Note: You cannot delete the default team. Set another team as default first.

Member Management

Adding Members

1. Select a team
2. Click Add Member
3. Enter the user's email address
4. Select their role (Member or Admin)
5. Click Add

If the user doesn't exist, an invitation needs to first be sent to their email from the Admin panel.

Screenshot: The add member dialog

Roles Explained

A tenant administrator can manage organisation-wide settings, but that authority does not automatically mean they are a team administrator or hold a team's encryption key. Team membership, the team administrator role, and team encryption access must each be granted deliberately.

Granting TEK (team encryption key) Access

When new members join, they need TEK access to view encrypted content:

1. You'll see a notification banner when users are waiting
2. Go to Teams and select the team
3. Find the member with "Pending Access" badge
4. Click Grant Access

The member's public key is used to wrap the TEK, giving them access.

Screenshot: The pending access banner and grant access button

What TEK Approval Gates

TEK approval controls access to team content — the team vault, shared folders, and team recipients. Whether it also gates sending safedrops is your choice:

• Default: members cannot send safedrop until you grant them TEK access.
• Optional: turn on "Allow members to send before TEK approval" (Organization Settings → Security Policy) to let new members send immediately. Their messages are delivered normally; once you grant TEK access, their browser automatically backfills the team-key wrap on those messages so they become admin-recoverable like any other. Changing this toggle is recorded in the audit log.

While a member is pending, vault-dependent actions (Send from Vault, team recipients, team folders) stay disabled with an "awaiting admin approval" hint.

Viewing Member safedrops (Admin)

As a team admin with TEK access, you can open a safedrop sent by a member of your team and read its content. Because you're not a recipient, the viewer first shows an explicit "View as team admin" button — nothing is decrypted until you click it. Decryption then happens entirely in your browser using your wrapped team key, so the server never sees the plaintext, and the viewer shows a clear "Viewing as team admin" banner.

Accountability and limits:

• Every admin view is audit-logged (who accessed which message's keys, and when). Any retrieval of a message file's keys by someone who is not the sender or a recipient is recorded, so member privacy is accountable.
• Team boundary model: the team is the trust boundary — technically, any team member holding the TEK could retrieve a sent message's wrapped keys via the API (the UI only surfaces viewing to admins, and all such access is audited). Users who need privacy from teammates or admins should use their own single-member team.
• Messages sent before TEK approval (and not yet backfilled) have no team-key wrap, so admins cannot read them; the viewer explains why.
• You cannot view messages from teams where you are not an admin with TEK access.

Removing Members

1. Select the team
2. Find the member
3. Click the menu on their row
4. Select Remove from Team
5. Confirm the removal

Note: Removed members lose access immediately. They cannot decrypt any team content.
Before removing a team administrator, verify that another suitable team administrator is active and has the access needed for routine work. For a departing tenant administrator, follow the administrator offboarding steps.

👥 User Management

Viewing All Users

1. Go to Admin → Users tab
2. View all users in your organisation
3. See their status, role, and verification state

Screenshot: The user management table

User Status Indicators

Resetting User 2FA

If a user loses access to their authenticator:

1. Find the user in the list
2. Click the menu
3. Select Reset 2FA
4. Confirm the action

The user will need to set up 2FA again at next login.

Deleting Users

1. Find the user
2. Click the menu
3. Select Delete User
4. Confirm deletion

Warning: This removes the user from all teams and revokes all access.

⚙️ Organisation Settings

Accessing Settings

1. Go to Admin → Settings tab
2. Configure organisation-wide options

Branding

Security Settings

Embedding Settings

Control how safedrop forms can be embedded:

Message Settings

Storage Management

📊 Viewing Storage Usage

1. Go to Admin → Storage tab
2. See total storage used
3. View breakdown by team

📦 Storage Limits

Your plan includes a storage allocation. When approaching limits:

• Users receive warnings when uploading
• Uploads are blocked when limit is reached
• Contact your safedrop account manager to increase limits

📝 Audit Logs

🔎 Viewing Audit Logs

1. Go to Admin → Audit Logs tab
2. Browse security-relevant events
3. Filter by user, action, or date range

📋 Events Logged

Audit Privacy and Retention

Configure both settings during setup:

1. Review whether audit events may include personally identifiable information. Enabling PII can provide names and other context useful for attribution and investigations. It also makes the log more sensitive, increases the impact of unauthorised access or export, and may create additional privacy, disclosure, and deletion obligations. Disabling it reduces that exposure but can make investigations less direct. Record the risk-based choice and who approved it.
2. Set the audit-log retention period. Base it on investigation needs, regulatory or contractual requirements, and data-minimisation policy. A short period may remove evidence before an incident is discovered; a long or permanent period increases the amount of personal and security data exposed and may conflict with retention obligations.

Limit access to audit logs and exports, monitor administrator and emergency-account activity, and review these settings periodically.

Exporting Logs

1. Filter to your desired date range
2. Click Export
3. Download CSV file

🛡️ Security Administration

Key Rotation

Rotate team encryption keys for security:

1. Go to Teams
2. Select the team
3. Click Security tab
4. Click Rotate Keys

All team members receive new wrapped keys. Files are re-encrypted with the new key.
Note: Key rotation may take time for teams with many files.

Account Recovery

When users cannot access their accounts:
Tier 1 Recovery (Self-Service):

• User uses their 12-word recovery phrase
• No admin intervention needed

Tier 2 Recovery (Admin Assisted):

• User requests admin recovery
• Admin verifies identity out-of-band
• Admin initiates account reset
• User creates new credentials

|||
User recovery does not replace administrator continuity planning. If the only available administrator cannot sign in, use the organisation's pre-established emergency-access arrangement; do not create or enrol an unplanned third-party account during the incident.

Monitoring Failed Logins

1. Check audit logs for failed login attempts
2. Look for patterns indicating attacks
3. Consider temporarily locking affected accounts

Best Practices for Administrator Resilience and Emergency Access :

Day-to-day administrator cover

Named day-to-day administrators are the primary protection against absence and offboarding risk:

• Wherever possible, maintain at least two active, individually assigned tenant administrators. Each should use their own account and MFA so actions remain attributable.
• Maintain at least two appropriate tenant administrators on each team wherever possible. Confirm both can perform the membership and TEK-approval work expected of them. (Team admins are planned, but not here yet)
• Review administrator assignments regularly and before planned leave or offboarding. Emergency access supplements this redundancy; it should not replace it.

Preferred model: organisation-controlled break-glass account

The preferred emergency model is a dedicated, non-personal account controlled by your organisation. Establish it during setup so it is ready if all normal tenant administrators are unavailable. Do not use it for routine work or assign it to an individual employee.
Grant only the access required by the documented recovery objective, we suggest:

• create an account like admin@acme.com and add as a tenant admin
• • carefully note password, 2fa details (set string and or QR code) and passphrase. save these somewhere REALLY SAFE
• every time you add a new team, add that account to the team
• test this account periodically

🆘 Optional model: safedrop-managed emergency cover

An organisation may opt into a dedicated emergency user controlled by safedrop support. This must be configured as standing emergency cover from day one, with access and activation governance agreed in advance; it is not an account first created during an incident.
To begin the setup process, email support@safedrop.com. The email is a request to agree and configure the arrangement. It does not, by itself, authorise safedrop to access the tenant or activate the emergency user.
A permanently enrolled third-party user weakens the organisation-only security boundary: the account and its standing permissions remain an additional path into the tenant even while dormant. Decide separately whether it receives:

1. tenant-administrator authority;
2. administrator membership in specified teams; and
3. TEK access for specified teams.

Grant only the standing access the organisation has deliberately accepted and documented. Treat TEK access, and therefore potential encrypted-content access, as a separate and substantially higher-risk decision. Support-controlled emergency cover intended only to restore tenant administration should not also receive team or TEK access.

Governance for either emergency model

Document and operate the arrangement:

• protect credentials and MFA factors separately using organisation-approved controls; do not share them with routine administrators;
• define who may authorise activation, how their identity is verified, and the actions permitted;
• monitor audit events for enrolment, permission changes, sign-in, and use of the emergency account;
• periodically review its owner, permissions, team memberships, TEK access, and continued need;
• test access at an agreed interval without reading encrypted content unless that test is specifically authorised;
• notify the customer organisation when an emergency account is activated or used;
• after use, review actions and audit records, rotate or reset credentials and MFA as appropriate, and remove any temporary access;
• remove the account, memberships, and access when the arrangement is no longer required.

For the safedrop -managed option, capture the agreed activation, notification, review, and termination process during setup rather than assuming support terms that have not been agreed.

Team Structure

1. Create logical teams - Based on departments or projects
2. Limit admin roles - Only grant admin where needed
3. Maintain team-admin cover - Assign at least two suitable administrators per team wherever possible
4. Review memberships regularly - Remove inactive members
5. Use meaningful names - Make team purposes clear

Security

1. Require 2FA - Enable organisation-wide 2FA requirement
2. Complete the setup checklist - Record every required configuration and risk decision
3. Monitor audit logs - Check regularly for unusual and emergency-account activity
4. Prompt TEK approvals - Don't leave users waiting
5. Rotate keys annually - Maintain encryption hygiene

User Management

1. Verify identities - Before granting access or recovery
2. Offboard promptly - Remove departed employees immediately
3. Document roles - Keep records of who has admin access
4. Train users - Ensure users understand security features

Administrator Offboarding

Before deactivating or deleting an administrator:

1. Confirm another active tenant administrator will remain; wherever possible, restore the recommended minimum of two.
2. For every affected team, confirm at least two suitable team administrators remain where possible and that the required TEK approvals are complete.
3. Transfer operational records and ownership of periodic access reviews.
4. Remove the departing person's tenant role, team memberships, and access promptly.
5. Review audit events for unexpected recent changes.
6. If the person had custody of emergency credentials or MFA, replace those credentials and review the emergency arrangement.

🔧 Troubleshooting

User Cannot Access Team

1. Check they're added as a team member
2. Verify their TEK access has been granted
3. Have them try logging out and back in
4. Check they've verified their email

No Day-to-Day Administrator Is Available

1. Do not create an ad hoc shared or third-party administrator account.
2. Use the organisation's pre-established break-glass account or agreed safedrop -managed emergency user.
3. Follow the documented activation-authorisation and identity-verification process.
4. Grant no additional team or TEK access unless it is necessary and specifically authorised.
5. Monitor and record the activity, notify the organisation when the account is used, and complete the post-use review.
6. After service is restored, re-establish at least two active named tenant administrators and appropriate team-admin cover.

💾 Storage Limit Issues

1. Review storage usage by team
2. Identify large files that can be removed
3. Contact safedrop for limit increases

🔎 Audit Log Missing Events

1. Ensure you're looking at correct date range
2. Check event type filters
3. Some events may be delayed slightly

🆘 Getting Help

For issues beyond this guide:

• Technical Support - Contact safedrop support
• safedrop-managed emergency-cover setup - Email support@safedrop.com to begin an agreed setup process; email alone does not authorise tenant access
• Account Changes - Contact your account manager
• Security Incidents - Report immediately to safedrop security team

Updated on: 13/10/2026