Skip to main content
Last updated: September 14, 2026tiCrypt

Escrow Users

Prerequisites

Access Level:

Super-Admin

Permission Requirements

  • . Basic Key Escrow
    • Escrow own key
    • Check if own key is escrowed
  • . Key Escrow Administration
    • View all escrowed keys in the system
    • List escrow recovery keys
    • Delete escrowed keys
    • View Escrow groups
    • View Escrow users
    • Escrow public key
    • View history of all Sitekey-authorized Escrow actions

View Escrow Users​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click the Escrow Users in the left panel.
  4. View a list of all escrow users in the system.
note

Only users with Admin or Super-Admin roles can view escrow users.

Create a New Escrow User Account​

The escrow user registers their own account through the Connect Application, selecting the Escrow category and the escrow group you assigned them. See Get Started for the full procedure.

Tell them which escrow group they belong to before they start. It is the first thing the wizard asks, and they cannot proceed without it.

Once they have registered, activate the account as described below.

Delegate Escrow Permissions​

Escrow permissions are granted through a user's permission profile, and are separate from the escrow accounts themselves. This is how an administrator gets visibility into escrow without becoming an escrow user.

  1. Log in with an Admin or Super-Admin role.
  2. Go to Management in the top toolbar.
  3. Select the Users section.
  4. Select Users.
  5. Find and select the admin user you are delegating to.
  6. Click the Open Full Menu three-dot button in the top right panel.
  7. Select Open Overlay.
  8. In the overlay, select the Profile & Permissions card in the left panel.
  9. Go to the Basic Key Escrow and Key Escrow Administration sections.
  10. Set the permissions. The recommended set is:
  • Escrow own key
  • Check if own key is escrowed
  • View all escrowed keys in the system
  • List escrow recovery key
  • Delete escrowed keys — leave unchecked
  • View escrowed keys
  • View Escrow groups
  • View Escrow users
  • Escrow public key
  • View history of all site-key-authorized escrow actions
  1. Click Save in the top right panel.
warning

Delete escrowed keys is the one permission to withhold. Deleting an escrowed key removes the only recovery path for that user's data. Reserve it for Super-Admins.

caution

Only Admins and Super-Admins should manage escrow permissions at all.

Activate a New Escrow User​

  • Upon escrow account registration, each escrow user receives a private-public key pair.
  • Users may download keys with the default name or give each key a custom name.

To Escrow User​

  1. Send your escrow public key to the Site-key Admin.
  2. Optionally, ask about your escrow group.
  3. Wait to receive your signed escrow key request from a Super-Admin.

To Site-key Admin​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select Site-key category.
  4. Click Load key in the login page.
  5. In the pop-up, select your site-key file from your local machine.
  6. Click Open to import.
  7. Enter your account password.
  8. Click Login.
  9. In the new window, in the top left corner card, click Import Certificates.
  10. In the pop-up, drag-and-drop the escrow user's public key.
  11. Tick the Sign box.
  12. Enter your account password.
  13. Click Download to download the signed request locally.
  14. Send the signed request to a Super-Admin.

To Super-Admin​

  1. Download the signed escrow key request from the Site-key Admin.
  2. Go to the Management icon in the top left taskbar.
  3. Navigate to the Escrow section.
  4. Click the Escrow Certificates in the left panel.
  5. Click the Execute signed certificates button in the top right panel.
  6. In the pop-up, click Browse Files.
  7. Select the signed escrow key request file from your local machine and click Open.
  8. To execute, click Apply.
  9. Send the signed escrow key request file back to the escrow user.

To Escrow User​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select Escrow category.
  4. Click Load key in the login page.
  5. Open the signed escrow key file from the Super-Admin locally.
  6. Enter your account password.
  7. Click Login.

Edit an Existing Escrow User​

To Escrow User​

  1. Send your escrow public key to the Site-key Admin.
  2. Optionally, ask about your escrow group.
  3. Wait for your signed escrow key request from a Super-Admin.

To Site-key Admin​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select Site-key category.
  4. Click Load key in the login page.
  5. In the pop-up, select your site-key file from your local machine.
  6. Click Open to import.
  7. Enter your account password.
  8. Click Login.
  9. In the new window, in the top left corner card, click Import Certificates.
  10. In the pop-up, drag-and-drop the escrow user's public key.
  11. Click the Edit button in the top left card.
  12. In the pop-up, update the escrow user metadata.
  13. Click Save.
  14. Tick the Sign box in the top left card.
  15. Enter your account password.
  16. Click Download to download the signed request locally.
  17. Send the signed request to a Super-Admin.

To Super-Admin​

  1. Download the signed escrow key request from the Site-key Admin.
  2. Go to the Management icon in the top left taskbar.
  3. Navigate to the Escrow section.
  4. Click the Escrow Certificates in the left panel.
  5. Click the Execute signed certificates button in the top right panel.
  6. In the pop-up, click Browse Files.
  7. Select the signed escrow key request file from your local machine and click Open.
  8. To execute, click Apply.
  9. Send the signed escrow key request file back to the escrow user.

To Escrow User​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select Escrow category.
  4. Click Load key in the login page.
  5. Open the signed escrow key file from the Super-Admin locally.
  6. Enter your account password.
  7. Click Login.
note

The escrow user must log in using the updated public key file containing the edits. No other public key is accepted.

Delete an Existing Escrow User​

To Super-Admin​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click the Escrow Users in the left panel.
  4. Select the escrow user for whom you want to create a deletion request.
  5. Click the Create deletion request button in the top right panel.
  6. Select the destination folder for the deletion request on your local machine.
  7. Click Save.
  8. Send the deletion request to the Site-key Admin.

To Site-key Admin​

  1. Download the escrow user deletion request from the Super-Admin.
  2. Open Connect Application.
  3. Select your deployment card.
  4. In the login window, select Site-key category.
  5. Click Load key in the login page.
  6. Open your site-key file from your local machine.
  7. Enter your account password.
  8. Click Login.
  9. In the new window, in the top left corner card, click Import Certificates.
  10. In the pop-up, drag-and-drop the escrow user's deletion request file.
  11. Click the Delete button in the top left card.
  12. In the pop-up, click Delete to proceed.
  13. Tick the Sign box.
  14. Enter your account password.
  15. Click Download to download the signed escrow user deletion request locally.
  16. Send the signed escrow user deletion request back to the Super-Admin.

To Super-Admin​

  1. Download the signed escrow user deletion request from the Site-key Admin.
  2. Go to the Management icon in the top left taskbar.
  3. Navigate to the Escrow section.
  4. Click the Escrow Certificates in the left panel.
  5. Click the Execute signed certificates button in the top right panel.
  6. In the pop-up, click Browse Files.
  7. Select the signed escrow user deletion request file from your local machine and click Open.
  8. To execute, click Apply.
note

The deletion request includes the Request Type, User ID, Name, and Email. In the backend, the signed certificate serves as an order to remove an escrow user. The Site-key Admin must coordinate with the Super-Admin to add or remove escrow users. Only signed orders from the Site-key Admin can create, edit, or delete escrow users.

Recover a User's Private Key​

Key recovery, also called de-escrowing, is the reason escrow users exist. It reverses enrollment: each escrow group contributes the key part it holds, the key parts are combined to reconstruct the Recovery Key, and the Recovery Key decrypts the user's stored private key.

Before you begin​

  • The user's key was enrolled in escrow. A key that was never escrowed cannot be recovered by any means, and no procedure here changes that.
  • Every escrow group can produce a participating member. Any one member of a group can act for it, because all members of a group hold the same key part. A group that can field nobody stops recovery outright.
  • An escrow user is available to receive the key parts and perform the reconstruction. It can be any escrow user, including one who is not a member of any contributing group.
  • Your institution has a way to hand the recovered key and a new password to the user securely, outside tiCrypt.

Who does what​

ParticipantContribution
One escrow user per groupSupplies their group's key part. It does not matter which member, only that every group is represented.
A receiving escrow userCollects the key parts from every group and reconstructs the Recovery Key. Any escrow user can do this once they hold every key part; they do not need to belong to a contributing group.
AdministratorNothing cryptographic. Administrators can require escrow on an account, but they do not take part in recovery and cannot decrypt the result.

How recovery proceeds​

  1. One escrow user from each group logs in through the Escrow category of the Connect Application and shares their group's key part with the escrow user who will perform the recovery.
  2. Once that escrow user holds a key part from every group, the key parts combine to reconstruct the Recovery Key.
  3. The Recovery Key decrypts the user's stored private key.
  4. The recovered key is passed to the user together with a randomly generated password, through a channel outside tiCrypt. Each institution decides what channel is acceptable for this.
  5. The user signs in with the recovered key and that password, then sets a new password. Doing so generates a new private key and invalidates the recovered one.
Result: The user has access again under a new private key. The key that was recovered no longer opens anything, which limits what the handover in step 4 was worth if it was intercepted.
caution

Recovery needs breadth, not depth. Three members of one group cannot substitute for one member each from three groups, because those three people all hold the same key part. If a group has lost every member, the keys enrolled against that group cannot be recovered.

info

The step-by-step interface actions for sharing a key part are not yet documented here. If you are an escrow user being asked to take part in a recovery, your Site Key Admin will tell you what to provide. See Get Started.

Bulk Email Escrow Users​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click the Escrow Users in the left panel.
  4. Select the escrow user(s) you want to send a bulk email to.
  5. Click the Bulk Email button in the top right panel.
  6. In the pop-up, click Copy to copy the emails or click Download to download the emails.
  7. Once done, click Close.

Change the Password of an Escrow User​

To Escrow User​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select Escrow category.
  4. Click Load key on the login page.
  5. Open your escrow key file.
  6. Enter your password.
  7. Click Login.
  8. In the new window, select the Change password button in the top right corner.
  9. In the pop-up, enter the current password.
  10. Enter the new password and confirm it.
  11. Click Update.
note

You are prompted to log out, and your new key is downloaded. Use this new key to log in next time.