# Vaults and sharing

> Palladin documentation · 1.0 · EN · 2026-10-25


## How do you share a vault?

Sharing a vault gives the recipient permission and an encrypted copy of its **Vault Key (VK)**. The recipient opens that copy with their private key. They do not receive your private key or master password.

<figure class="doc-diagram"><ol><li>Owner unlocks the vault</li><li>App protects the key for the recipient</li><li>Server stores the encrypted copy</li><li>Recipient opens it locally</li></ol><figcaption>The same vault key is protected separately for each authorized person.</figcaption></figure>

## The correct recipient

The app checks the recipient's identity, key, and vault membership. Signing in alone does not let someone substitute a key or gain access to data.

## Updating an entry

Changing an entry creates a new data version. Copies shared with agents must match it. An authorized user app prepares them: the server does not hold the keys needed to decrypt and rebuild the content.

## Removing access

Removing a member blocks further retrievals. Protecting new data from someone holding an old key requires changing the key and protecting data for the remaining recipients. It does not erase copies the removed member has already read. See [revocation and rotation](/docs/whitepaper/revocation).