User Security Practices

ExaVault user accounts can represent either a person or an automated workload. Give each person and each workload its own identity so permissions and activity records remain attributable to one actor.

Use One Account Per Person

Create a separate user account for every person who accesses ExaVault. Do not share a username and password among a team.

When several people need the same access, use a group to assign their common folder rights while keeping individual user accounts. Individual accounts let you disable one person's access without changing credentials for everyone else and let the Activity log show who performed each action.

People who use the web interface should configure two-factor authentication. Never use a shared administrator account for routine file access.

Use One Account Per Workload

Create a dedicated account for each script, integration, device, or external system. Do not let a person sign in interactively with the same credentials an automated workload uses.

Separate workload accounts prevent one credential change from breaking unrelated systems. They also make it possible to identify the responsible integration in the Activity log, rotate one credential at a time, and disable a retired integration without affecting people or other workloads.

For unattended SFTP connections, use SSH key authentication when the client supports it. Keep the private key only on the system that owns the workload. When a protocol or application requires a password, give the workload a unique password that is not used by a person or another integration.

Grant the Minimum Access Required

Set the account's Home Directory as narrowly as the workflow permits. Grant only the file operations the person or workload needs. For example, an upload-only process generally should not receive download or delete rights.

Review both user-level and group-level access. ExaVault combines all permissions granted directly to the user, through group membership, and on parent folders. The Folder Permissions page explains how access combines and which permissions common file operations require.

Protect and Rotate Credentials

Store passwords and private keys in an approved password manager or secrets system rather than in source code, scripts, tickets, or email. Limit who can read machine credentials.

Rotate a credential when its owner changes, when a system is replaced, or when exposure is suspected. Update the consuming system, verify a successful connection, then retire the old credential. For SSH keys, remove the old public key from the ExaVault user after the new key is working.

Review and Remove Access

Periodically review enabled users, group membership, Home Directories, and access rights. Disable accounts promptly when a person leaves, a partner relationship ends, or a workload is retired.

Use the Activity log to investigate use before disabling or deleting an account. A unique account per actor makes that review meaningful and helps identify dependencies that still need to be migrated.