Lexful staff using their Lexful system accounts cannot retrieve or directly set, change or clear secret and TOTP fields in your customer account. They may still access records and non-secret fields where their permissions allow. This distinction matters when assessing access to your clients’ credentials.

This protection is enforced by the application’s backend. It is not a claim of zero-knowledge encryption or a guarantee that Lexful’s infrastructure cannot decrypt stored credentials.

The service checks the account a user belongs to—their home account—against the account holding the record. A staff system role does not bypass this check. The restriction covers fields configured as Secret or TOTP, including passwords and the stored secrets used to generate time-based one-time codes on standard and custom asset types.

The backend rejects these requests with an insufficient-access error. Hiding a button in the app is not the enforcement mechanism.

Where their permissions allow, staff can list and open records, inspect non-secret content and history, and help with fields such as names, usernames, website URLs, notes and tags. They can create a record without setting secure values, subject to the asset type’s required fields, or update its other fields without replacing existing secrets.

This is not a restriction on all customer data. A password pasted into a note, document, attachment or other ordinary field does not receive this secure-field protection. Store credentials in the appropriate Secret or TOTP fields, and redact them from screenshots and support messages.

The check is based on account membership, not whether a person is employed by Lexful. If you create a user in your own account for a Lexful employee, that user is subject to the same permissions and access rules as your other account members. The cross-account restriction does not block them from accessing secrets that their customer-account permissions permit.

API keys act as their associated user. An integration authorized through a customer user’s API key may read or write secure values within that user’s access. Review the permissions you grant and remove temporary access when it is no longer needed.

See Manage users and permissions, Understand record, folder and tag access and Create and manage API keys.

Authorized backend processing uses an internal service identity that can work with secure values across accounts. This supports operations such as migrations, integrations and copying assets without giving staff system accounts direct access to the values. The internal role cannot be assigned to a user through Lexful’s user-management interfaces.

This distinction preserves automated processing; it does not mean every backend operation runs with the requesting staff user’s restrictions.

Enable password reveal, under Settings → Asset types → Passwords, controls whether the app offers the reveal action. Disabling it does not disable authorized copying or make the password inaccessible through the API. Your users’ underlying permissions and access rules still apply.

Secure-value reads through the record API generate audit events, including requests used to reveal or copy a password. Review recorded activity in Platform → Logs, or use Trace to investigate a user’s activity. See Search audit activity and trace a user.

These logs are not a complete audit of infrastructure access. An empty search means no matching retained events in the selected scope and period; it does not establish that a value has never been accessed.

For support, provide the affected record or job ID, the action you attempted, the time and a redacted error message. Do not send passwords, TOTP setup secrets or one-time codes. Use an authorized user in your account when a secure field needs to be changed directly.

This is an application authorization control, separate from encryption at rest. The service retains the ability to decrypt credentials for authorized operations. It is not end-to-end encryption with keys held only by your organization, and it does not by itself establish restrictions on database, infrastructure or deployment access.

For a security assessment, review this control alongside Data Security and Privacy FAQ and request the applicable infrastructure-access and operational-control evidence from Lexful. This article does not assert customer-approved support sessions, time-limited staff access or complete infrastructure audit coverage.