Onboarding a New Hire Without Leaking a Single Password

Picture a small Swiss business — a design studio, a trades firm, a boutique agency, it doesn't matter which — with eight employees and a new hire starting on Monday. Over the weekend, the office manager realizes the new person will need access to the shared email marketing tool, the hosting panel, the accounting software login, the social media accounts, and the Wi-Fi password for the back office. That's a typical Monday morning for thousands of Swiss KMU, and it's exactly the moment where password hygiene usually falls apart.

The usual options are not great. Someone pastes credentials into a WhatsApp message. Someone else keeps a spreadsheet called "Logins_final_v2.xlsx" on a shared drive. A few companies pay for a dedicated password manager like Bitwarden or LastPass, but then it's yet another tool, another subscription, and another login to manage separately from the rest of the business.

The scenario: new hire, quarter-end, and an audit — all in the same month

Let's walk through how this plays out when the business is already running on Flitz, where the password vault lives inside the same workspace as accounting, invoicing, and HR.

Monday: the new hire needs access

The office manager opens the Passwords module and finds the folders already organized by function: "Marketing Tools," "Hosting & IT," "Finance Logins," "Social Media." Because folders — not individual passwords — are the sharing unit, granting access takes two clicks: select the new employee, select the folder, done. No one reads out a password over a desk or types it into a chat app. The new hire logs into Flitz with their existing company account — no second master password to create or forget — and the shared folder is simply there.

Mid-month: the auditor asks about access control

During quarter-end, the external auditor or fiduciary reviewing the books asks a standard governance question: who has access to the online banking portal and the accounting system, and how is that access protected? This is often where SMEs stumble, because the honest answer is "we're not entirely sure — it's in a few people's browsers and one shared note." With a built-in vault, the answer is straightforward: access is folder-based, only the folder creator can grant new permissions, and every password is encrypted client-side before it ever reaches a server — meaning even the Tenant Owner cannot casually read stored credentials. That's a materially stronger answer than "trust us," and it takes no extra documentation effort because the structure already enforces it.

End of month: 2FA codes stop living on someone's personal phone

The same review often surfaces a second issue: two-factor authentication codes for shared business tools are set up on one employee's personal phone, via an authenticator app. If that person is on holiday or leaves the company, everyone else is locked out. The built-in TOTP support solves this cleanly — rotating 6-digit codes live in the same vault as the password itself, in the same folder, accessible to whoever has been granted that folder. No one needs to install or manage a separate authenticator app, and no business-critical code is tied to a personal device.

Later: an employee leaves unexpectedly

Every business eventually deals with a termination that isn't amicable, or a departure where the employee is unreachable. Normally this means a scramble to reset every password the person might have known. With Tenant Owner emergency access, the business owner can step in and access vault contents when needed — and because every such access is paired with mandatory notification to affected users, this isn't a silent backdoor. It's a documented, transparent safety net rather than an invisible override, which matters both for trust inside the team and for explaining the process to an auditor or legal advisor later.

Why the mechanics matter, not just the convenience

The zero-knowledge encryption is the part that's easy to overlook because it's invisible in daily use — passwords are encrypted in the browser before they leave the device, so the server, and by extension any Flitz staff or even an admin inside the company, never has access to the plaintext values. That's the difference between "we have a password manager" and "we have a password manager that can't become a liability if the account hosting it is ever compromised."

The rest is just good design under the hood: a password generator for creating strong credentials on the spot, search to find the right folder in seconds, and an interface simple enough that onboarding a new hire into the system itself takes under a minute. None of this requires the business to buy, configure, or maintain a separate tool — it's part of the same workspace already running invoicing, banking, and HR.

The real takeaway

None of the events above — a new hire, an audit, a sudden departure — are unusual. They happen to nearly every Swiss SME sooner or later. What usually turns them into a scramble is the lack of a system built for exactly this. A password vault that's part of the core workspace, with folder-based sharing and client-side encryption, turns these moments from stressful exceptions into a two-click routine. You can see the full feature details at flitz.ai/features#passwords.