Onboarding Your Team to StretchVault

Adopting a secrets manager is as much about process as product. This guide gives you a practical rollout plan to move a team off spreadsheets, sticky notes, and chat messages into StretchVault — cleanly and securely.

Before you start

1. Confirm encryption is ready: open the Health tab and check that encryption shows as enabled. If it isn't, resolve that with your administrator first — you shouldn't import secrets until it is.
2. Make sure your teammates are part of the StretchSuite workspace, since StretchVault uses your existing organization and roles.
3. Decide who your owners/admins are. Keep this circle small; admins can reveal across the vaults they administer.

Step 1: Design your vaults

Plan vaults around who needs access, not just topic. A common, effective layout:

• Shared Ops — accounts most of the team uses (the shared email tool, project tracker).
• Infrastructure — servers, databases, and API keys, restricted to technical staff.
• Client Credentials — logins you manage for clients, shared per client.
• Finance — payment cards and billing logins, restricted to finance.

Create these in the Vaults tab before importing anything.

Step 2: Import your existing credentials

Work through your current spreadsheet or notes one row at a time:

1. Click New vault item and pick the right vault.
2. Choose the item type (Login, Secure note, Server, API key, Payment card).
3. Fill in the title, username, URL, and paste the secret.
4. Set the 2FA flag if the account uses two-factor.
5. Save. StretchVault encrypts and (if the engine is on) analyzes the secret immediately.

As you go, use folders (for example a folder per client) and tags (like billing or retire-soon) so the vault is organized from day one.

Step 3: Triage security immediately

Once your credentials are in, don't wait to clean them up:

1. Run Breach-watch on each vault for a fast list of exposed, reused, weak, old, and no-2FA items.
2. Run a full Watchtower review to get a scored baseline and save it to Audit history.
3. Use the Generator to replace weak and reused passwords, and the rotation plan to work through them by priority.

This first cleanup is often eye-opening — most teams discover several reused passwords they didn't know about.

Step 4: Set up sharing and delete the spreadsheet

1. For each teammate, share the specific items they need at reveal scope, with expiries for anyone temporary.
2. Confirm people can access what they need through StretchVault.
3. Securely destroy the old spreadsheet or notes. Leaving the old copy around defeats the entire exercise — and remember that any password that lived in a shared doc should be considered exposed and rotated.

Step 5: Establish an ongoing rhythm

• Run a saved Watchtower review monthly so your Audit history tells a continuous story.
• Generate a rotation plan quarterly and work the critical/high items.
• During offboarding, filter the Sharing tab by the departing person and revoke their grants, and rotate any shared secrets they could have seen.

A realistic example

Meridian Studio's owner blocks off a Friday afternoon. She creates four vaults, imports 60 credentials from a spreadsheet, and tags client items by client name. Breach-watch immediately flags 5 exposed and 7 reused passwords; she regenerates them and updates the live systems. She shares each account manager's client items at reveal scope with no expiry, and the one freelancer's items with a 30-day expiry. Then she deletes the spreadsheet. By Monday, the team logs in through StretchVault, the owner has a saved baseline Watchtower score, and no password is sitting in a shared doc anymore.

Tips

• Import highest-risk credentials first (infrastructure, finance) so the most sensitive values are protected soonest.
• Rotate anything that lived in a shared document as you import it — assume it was already exposed.
• Keep the admin circle small and grant per-item reveal for everyone else.
• Save that first Watchtower run — it's the baseline you'll measure all future improvement against.

Troubleshooting

"StretchVault encryption is not configured" during import. Stop and fix encryption on the Health tab before continuing; don't try to store secrets until it's enabled.

Teammates can't see items after import. They need per-item grants (or an admin role). Share the items they need at reveal scope.

Security tools aren't scoring items. Strength analysis, Breach-watch, and Watchtower need the security engine. Check the Health tab and contact your administrator if it's offline.