Skip to content

When someone leaves the organization

Problem: A colleague is moving to another school. From now on, she should no longer be able to open team folders or read future changes – while everyone else’s work carries on.

Solution: Lock the person in the web administration and “renew key” for confidential team folders. If no manager is available, emergency access under the four-eyes principle helps.

Result: The former member no longer has access; new and changed files are unreadable for her, even with an old copy of the key.

1. Lock the person (IT administration)

  1. Web administration › People › open the person › “Lock person …”.
  2. Leave “Remove all devices” ticked; if needed, also remove direct memberships and groups.
  3. “Lock now”. The person can no longer sign in or open any team folder, effective immediately – not even through groups.
  4. Also lock the account at the identity provider (Entra ID or Keycloak).

The person’s page lists the team folders whose keys they had.

2. Renew the key (manager)

Anyone who had the key of a team folder could still open a copy of the encrypted files. For confidential folders, therefore:

  1. In the Krywerk app, on the team folder: “Manage” › “Renew key …”.
  2. Krywerk creates a new key, re-encrypts all files with it and grants the remaining members access. This takes a while for large folders; if interrupted, continue with “Resume key renewal …”.
  3. Afterwards, keep the new recovery key safe – the old one is no longer valid.

Renewing the key of a team folder

3. When nobody manages the folder anymore

If the former member was the only manager of a team folder, a new manager gets access via emergency access: they submit a request with “Request emergency access …”, and at least two members of the emergency council approve it (“Approve …”) – no single person can decrypt alone. Alternatively, the recovery key opens the folder.

Erasure request

If the person requests erasure of their data (Art. 17 GDPR): after locking, choose “Delete person permanently …” in the web administration. In the audit log they remain only in pseudonymized form (Data flows).

Next steps