Password manager for small accounting firms (per-client isolation, audit-clean)

The accounting firm credential graph

A 5-staff accounting firm with 25 active clients has roughly this layout:

• 25 client vaults (one per client)
• 1 internal firm vault
• Each staff member has access to ~8 of the 25 clients
• Each client vault holds 4-8 credentials (accounting software, payroll, bank portal, tax authority)

That’s ~150 credentials across the firm, with overlapping access patterns and quarterly rotations.

LitePassword’s per-vault access model is shaped for this.

Per-client isolation, structurally

Every client gets a shared vault. The vault’s encryption key is wrapped with each granted staff member’s master-derived key. Staff who haven’t been granted access literally cannot decrypt that vault’s contents — not because UI hides it, but because their account doesn’t have the wrapped key.

Practical implication: when a client asks “who at your firm can see my QuickBooks?” — you open Manage Vault Access on that client’s vault and read off the list. Cryptographically enforced, not policy-enforced.

End-of-engagement cleanup

When a client engagement ends:

1. Open the client’s vault in Vault Access settings.
2. Remove every staff member except 1-2 firm partners (for records retention).
3. The vault key rotates automatically. Staff cached copies become undecryptable.

If you eventually delete the vault entirely, the encrypted blobs are deleted from our servers within 30 days. Because we held only ciphertext, there is nothing readable left.

Seasonal staff

Tax season brings 2-3 seasonal hires. The pattern:

1. Invite each as View only on Business plan.
2. Open Manage Vault Access → grant per-client access.
3. They work the season.
4. Season ends → Users page → Revoke Access on each.
5. Vault keys rotate. They keep their private vault for personal credentials; firm credentials become inaccessible.

What this does not solve

• TOTP code generation. LitePassword does not generate active TOTP codes. Use Google Authenticator, Authy, or 1Password’s TOTP feature alongside. Store the backup seed and recovery codes in a Secure note in LitePassword.
• IRS Pub 1075 compliance. We are not certified. If your engagement requires it, use Keeper.
• Automated credential rotation. You still have to log into each client’s tool and rotate manually quarterly. LitePassword stores the new value; it does not perform the rotation.

For a deeper dive on offboarding patterns, see How to revoke shared password access when someone leaves.