Vault for marketing & creative agencies

Client ad accounts and social logins that stop living in a pinned chat message

An agency holds the keys to its clients’ most public assets: the ad accounts, the analytics properties, the social profiles, the CMS. They get shared in a channel because the account team changes and the password has to reach the new person tonight. Vault gives each client a collection, shares it with the named people on the account, and records who opened what — which is also the answer when a client asks how their account was accessed.

Talk to us Everything Vault does

Included in every plan. No per-seat charge, no per-tool upsell.

In practice

What Vault does for marketing & creative agencies

A collection per client, shared with the account team

Ad platform, analytics, social, CMS and domain logins grouped per client and shared with exactly the strategist, designer and account manager on that account. When the team changes, the sharing changes; the password does not have to be re-sent.

Encrypted in the browser, unreadable to us

Items are encrypted on the member’s device with a key derived from their passphrase. Orbiz stores ciphertext only, so a client asking where their credentials are held gets an answer they can put in their own security review.

Escrow recovery for the designer who forgot

A forgotten passphrase goes through an escrow flow your admins control, restoring access without anyone reading the client’s logins. Nothing is written down, nothing is emailed.

Audit log per client

Every read, share and change is recorded with who and when, filterable by collection. When a client’s ad account is changed unexpectedly, you know which of your people opened the credential and when.

One platform

Where Vault hands off for a agency team

Vault shares with the same members as the rest of the platform, so a designer who leaves and is marked inactive in HRMS loses access to every client collection in the same moment. Rotating the passwords remains your task; the list of what they could see is already there.

Agencies · Vault

Questions agency teams ask about Vault

Can we give a client read access to their own collection?

A client contact can be invited as a member of your organisation with a role that can read only their collection. Their access ends when their membership does. A collection is never opened by public link. For a single password a client needs once, a Send seals that one field into a link that expires, can burn after the first read, and can be revoked.

What about two-factor codes for client accounts?

Recovery codes and shared secrets are stored as encrypted fields on the item like any other value. Vault does not generate time-based codes itself today, so the authenticator remains a separate app; the seed to set it up is kept safely in the vault.

How is this different from the agency’s 1Password or LastPass account?

The vault is part of the same platform as your people and roles, so access follows the team automatically, and it is included in the flat price rather than billed per seat. It does not have browser autofill or a mobile app yet, which a dedicated password manager does; the browser extension is planned but not available.

Want Vault set up for your agency team?

It comes with every plan, alongside the other tools. Tell us your team size and we set up a working organisation for you to try.