The Koru Clinical Password Manager is a secure, web-based vault that stores all the usernames and passwords your team uses every day.

It replaces the risk of passwords shared by email, stored in spreadsheets, or written on sticky notes — with a single, controlled, auditable system accessible only to authorised team members.

Users sign in with their email address and password. New users receive a secure invite email and set their own password — no admin needs to create one for them.

If a user forgets their password, they can click "Forgot your password?" on the login screen to receive a reset link by email — valid for two hours.

The vault opens to a search-first view — nothing is shown until you search or select a category. This reduces shoulder-surfing risk and keeps the screen clean.

Category pills appear at the top for quick browsing. Each entry shows the site, username, category, and a link to open the site. Use Copy username and Copy password to grab credentials without revealing them on screen.

Access is controlled at two levels. First, each user is assigned to one or more categories — they only see passwords in those categories.

Second, each password entry has a "Who can access" setting: Everyone, Admins only, or specific email addresses. Admins always see everything. Entries marked "Admin only" are invisible to staff regardless of their category assignments.

Admins invite users from the Users tab. Fill in their name, email, role, and tick which categories they should access. An invitation email is sent automatically — valid for seven days.

Users show a Pending badge until they've set their password. Admins can edit details, reset passwords, change category access, or delete users at any time.

Categories are managed from the Categories tab — available to admins only. Add new categories, rename existing ones, or delete those no longer needed.

Renaming a category automatically updates all passwords and user assignments that reference it. A category can only be deleted once all passwords in it have been reassigned — the app tells you exactly how many need moving.

Every action in the system is recorded in the Audit log — accessible only to admins. It captures who viewed passwords, added or edited entries, invited users, changed categories, and more.

Each entry shows the timestamp, user email, and action. The most recent 100 entries are shown, newest first. Use it to monitor usage and ensure accountability across your team.