Organization File Vault for employees

Organization File Vault lets people who must not use the Trustity Cloud Portal upload, download, and share encrypted files under your tenant. Each employee signs in on a dedicated vault login, sees only files they uploaded, and never receives TCP roles, policies, devices, or audit pages.

This article is for organization owners and administrators who already have File Vault entitled. It is not a substitute for Personal Vault, which remains a per-user area inside the Cloud Portal.

What this is for

Use Organization File Vault when:

• Employees need a simple encrypted drop for work files
• Those people should not become Cloud Portal users
• Sharing must stay short-lived and password-protected
• Administrators still need a list of employee files for the organization

Do not use it as a general document-management system, as a replacement for classified collaboration platforms, or as a way to store credentials and unlock material.

Isolation and encryption model

Trustity keeps three boundaries in this feature:

Files are encrypted in the browser before upload. The key material needed to open a file is wrapped with the employee’s vault PIN (and optionally a one-time recovery key) on the device. Trustity stores only the wrapped material and does not hold the PIN, so Trustity operators and organization admins cannot decrypt PIN-protected employee files. Admins can still see file names, sizes, and owning employee for governance.

A published share link is a capability URL: the recipient must also have the share password (sent separately). Anyone with both the link and the password can download that one file until the link expires or hits its download limit.

Before you start

• File Vault is entitled for the organization
• Owner or Admin access with permission to write Vault policy
• A work email for each employee that is not already a TCP owner or team member
• An approved classification for files that may enter the vault
• The employee login URL from Security Policies → Vault / PAM / IPS after you publish
• A plan for how employees store their vault PIN and recovery key offline (Trustity cannot reset a forgotten PIN)

Publish the employee vault

1. Sign in to the Cloud Portal for the correct organization.
2. Open Security Policies and select the Vault / PAM / IPS tab.
3. In Publish vault to employees, turn the publish control on and wait for the success confirmation.
4. Refresh the page and confirm the control stays on. If it turns off, the publish flag did not persist - do not send the login link yet.
5. Copy the Employee login link. It points at /org-vault/login on the Cloud Portal host (trustity.io), not at trustity.co.
6. Optional: upload an organization logo. Employees see Trustity’s mark plus your logo. Removing the logo restores Trustity-only branding.

Unpublishing stops employee sign-in. Existing encrypted files remain in the organization until an administrator or the owning employee deletes them.

Invite employees

Leave the initial password empty to send an invitation email. The employee sets a password from the invite link and lands on the employee vault, not the Cloud Portal.

If you must create a temporary password instead:

1. Enter the work email.
2. Set a password of at least 10 characters.
3. Create the employee.
4. Send the password through an approved channel.
5. Confirm they must change it on first sign-in.

Use Resend invite when the email did not arrive. Disable an employee when they leave. Disabled accounts cannot sign in; their files remain listed for administrators until deleted.

Employee workflow

1. Open the employee login link your administrator provided.
2. Sign in with work email and password.
3. Set a new password when prompted.
4. On first upload, set a vault PIN (minimum 8 characters) and confirm it. Save the recovery key when it is shown - Trustity cannot recover it later.
5. Upload an approved file and wait for the encrypted-upload confirmation.
6. Use Decrypt only for files you uploaded. Enter the vault PIN (or recovery key) when prompted.
7. Use Share when a recipient needs a time-limited link. Set a share password and send it separately from the link.
8. Send the link (and the password) through approved channels.

Employees cannot open Cloud Portal navigation, other employees’ files, or another organization’s vault.

Administrator visibility

Owners and Admins can see employee file names, sizes, and owning employee in:

• Security Policies → Publish vault to employees
• Personal Vault, in the Employee vault files table

Decrypt is not available for PIN-protected employee files. Organization admins can inventory files for the tenant; they cannot open file contents without the employee’s vault PIN or recovery key. Personal Vault files owned by Cloud Portal users stay on the owner’s account and are not mixed into the employee list.

Sharing limits and expectations

Share duration and download counts follow the same Vault policy maxima used for Personal Vault. Prefer the shortest expiry and the fewest downloads that meet the business need. A share password is required before the recipient can decrypt. Deleting a file or disabling an employee does not erase copies a recipient already downloaded.

Verify

• Publish stays on after a full page refresh
• The employee login shows Trustity branding and, when configured, the organization logo
• A TCP user cannot sign in at /org-vault/login
• An employee cannot open /dashboard
• Employee A cannot list or decrypt Employee B’s files
• An administrator in this tenant can see the employee file list and cannot decrypt PIN-protected employee files
• A share link without the password fails
• An expired or exhausted link no longer downloads
• Decrypt after a new session asks for the vault PIN again

Roll back

Turn Publish vault to employees off to close the employee login. Disable individual employees to revoke their sign-in. Delete files only after retention review. Invite emails and share links already sent remain a business risk until they expire - treat that as an incident if the audience was wrong.

Troubleshooting

Related

• Personal Vault and sharing limits
• Security Policies hub
• User roles and invites
• Trustity sites, logins, and site map
• Audit Logs in the Cloud Portal