What should a small company look for in a password manager?

Start with a managed business product rather than building the service yourself. Compare options such as 1Password, Bitwarden, and Keeper on team administration, shared vaults, access removal, audit or activity records, and recovery procedures. The right fit depends on which controls you need and what the company is willing to pay for.

Do a small trial with a few real workflows before moving everything. Check how onboarding and offboarding work, how people share credentials without exposing them in chat, and whether the product supports the devices and browsers your team uses.

Be cautious about self-hosting just because it sounds more controlled. A service like Vaultwarden can reduce licensing costs, but then your team owns patching, backups, monitoring, availability, and recovery testing. For a seven-person shop with one operations person, that ongoing responsibility may outweigh the savings.

Also, a secrets vault designed mainly for machine-to-machine credentials is not automatically a good everyday password manager for staff. Match the product to how people will actually use it.

The boring parts matter most: set up company-owned administrative accounts, require strong sign-in protection, give each person an individual account, and put shared credentials in controlled shared vaults rather than passing them around. Make sure you can revoke someone’s access promptly when they leave.

For recovery, don’t depend on one person remembering a key or keeping it in a personal account. Document who can recover the business account, store any necessary recovery material in a company-controlled secure location, and periodically verify that the process works.

Shared password files can work for a tiny team, but they bring coordination problems. Two people editing at once can create conflicting copies, and a network share or sync service may not handle simultaneous changes cleanly. If you go that route, test conflicts and backups before trusting it with important credentials.

A team-oriented manager avoids much of that friction and usually makes it easier to assign access by person or group. I’d favor that unless you have a specific reason to accept the file-sharing maintenance.

Write down the handover plan now, while the setup is still simple. The company should own the subscription, billing contact, recovery process, and admin access. Keep a short runbook covering how to add and remove users, where shared credentials belong, and who handles recovery.

Then have someone other than the person who configured it follow the runbook. If they can’t, the setup needs more documentation before you roll it out.