As an identity, access, and password management platform for disconnected applications, data protection is vital for Cerby. We know passwords are essential assets of your organization, so we have built a multi-layered and comprehensive solution to protect them.

This article describes Cerby’s approach to protecting the passwords of the accounts you and your colleagues use daily to log in to their applications.

As in any password management platform, data encryption is at the core of Cerby and is part of the system and architectural protection for passwords. With this security method, only authorized users with access to the corresponding decryption keys can decrypt a password.

Whenever an organization creates a new Cerby workspace, the Cerby platform automatically generates a default cloud vault and its corresponding encryption keys, which are stored in the database and encrypted with the workspace KMS (AWS Key Management Service) key.

This vault is where users save their sensitive data (accounts and secrets), and Cerby offers the following vault encryption schemes, inclusive of the option referenced above:

The choice between cloud and local encryption schemes depends on customer security requirements and preferences. For more information, read the article How Cerby protects your data with cloud and local encryption.

On top of the system and architectural protection, Cerby offers the following features that enable organizations and end users to protect their passwords proactively:

The following sections describe each feature.

Cerby’s key differentiator is automation, and this approach to security is present in our strategy to protect your passwords: automated password rotations are available for multiple managed accounts,

IT admins can set workspace policies to rotate passwords periodically via automation. Also, Cerby can trigger this automated task based on user deprovisioning or user account deactivation events from an identity provider (IdP), such as Okta or Entra ID.

With automated and regular password rotations by policy, organizations achieve the following:

End users can also trigger automated password rotations manually with a single click in the Cerby web app.

It’s worth mentioning that, during automated password rotation, Cerby generates and sets secure passwords following the app’s strength rules.

For more information about automated tasks on managed accounts, read the article Explore the supported automated tasks for managed accounts.

As mentioned, Cerby generates and sets secure passwords when performing automated password rotations. However, you can also use the password generator in the Cerby browser extension to generate a secure password with the following customizable strength rules:

For more information about this feature, read the article Explore the Password Generator.

To protect access to a password without affecting productivity, you can set restrictions on view permissions for shared accounts. With this feature, users with the Collaborator role on an account can view or not the password through any of the Cerby client apps (web app, browser extension, and mobile app).

The following are the restriction types, depending on how they are enabled:

The following sections describe each restriction type.

The Cerby Technical Support team can customize restrictions for all workspace users. Based on customers’ needs and security policies, Cerby can enable or disable features for viewing and hiding passwords.

In the most restrictive configuration, Cerby limits a user's ability to view the password across all interfaces, requiring the user to always use Cerby to log in to their accounts.

The following are the features Cerby can enable or disable for a workspace:

You can contact the Cerby Technical Support team via email at support@cerby.com or through the help chat to request any of the features to be enabled or disabled.

Account Owners can set manual restrictions on individual accounts for viewing or hiding passwords. The Cerby Technical Support team must enable the display of the Collaborators can view the password for this account switch on the account details page of the Cerby web app.

As mentioned above, by activating or deactivating this switch, account Owners decide whether to hide or show passwords to account Collaborators who have shared access to an account.

This restriction is displayed in the Emergency controls expandable section of the account details page. When activated, account Collaborators can view the account password across all Cerby client apps.

Cerby is building a feature to suggest users not update their account passwords. Cerby will collect analytics data about password update attempts or if the user did change the password.