Skip to main content

Escrow Groups

Last updated: March 26, 2026Latest Frontend Version:

Understanding Key Escrow​

In tiCrypt, each user's data is encrypted with their private key. If a user loses their private key and password, their data is permanently unrecoverable. Key escrow provides a recovery mechanism by splitting a backup of the user's private key across multiple independent groups, so no single person or group can unilaterally recover it.

How escrow works:

  1. The Site Key Admin (an offline authority) creates and signs escrow group certificates.
  2. A Super Admin imports the signed certificates and creates the escrow groups in tiCrypt.
  3. Escrow users (at least three per group, organized into a minimum of three groups per deployment) each hold a shard of the recovery key.
  4. When an administrator marks a user for escrow, the user's next login generates a recovery key split across all escrow groups.
  5. Recovery requires one representative from each escrow group to contribute their shard. A missing shard from any single group makes recovery cryptographically impossible.

Setup order:

  1. Register a Site Key Admin account (see Site Key Training)
  2. Create escrow groups (this page)
  3. Register escrow users (see Escrow Users)
  4. Sign certificates (see Escrow Certificates)
caution

Complete escrow setup early in deployment. Without escrow, any user who loses their private key permanently loses access to all their encrypted data.

Access Escrow Groups​

  • There is no front-end access to escrow groups because they are decentralized in tiCrypt.
  • Escrow groups operate through offline meetings among members who know each other in person.

Create a New Escrow Group​

To Site-key Admin​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select the Site-key category.
  4. Click Load key on the login page.
  5. In the pop-up, select your site-key file from your local machine, and click Open.
  6. Enter your account password.
  7. Click Login.
  8. In the site-key dashboard, click the Add escrow group button in the top left.
  9. In the pop-up, enter the escrow group name.
  10. Click Create Request.
  11. Under the New Escrow Group card, tick Sign to sign the group certificate.
  12. Enter your password in the field in the top right panel.
  13. Click Sign all.
  14. Select the signed escrow group card in the top right panel.
  15. In the pop-up, click Export to download it locally.
  16. Send the signed escrow group file to a Super-Admin.

To Super-Admin​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click Escrow Certificates in the left panel.
  4. Click the Execute signed certificates button in the top right panel.
  5. In the pop-up, click Browse Files.
  6. Select the escrow certificate file from your local machine and click Open.
  7. To execute, click Apply.

Add Escrow Users to an Existing Escrow Group​

  • Upon account registration, users must select an escrow group.
  • As a best practice, Site-key Admins and Super-Admins should create a dedicated escrow group for all users to facilitate private key recovery in case of password loss.

Edit an Existing Escrow Group​

To Site-key Admin​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select the Site-key category.
  4. Click Load key on the login page.
  5. Open your site-key file from your local machine.
  6. Enter your account password.
  7. Click Login.
  8. In the site-key dashboard, click the Add escrow group button in the top left.
  9. In the pop-up, enter the escrow group name.
  10. Click Create Request.
  11. Under the New Escrow Group card, tick Sign to sign the group certificate.
  12. Enter your password in the top right panel.
  13. Click Sign all.
  14. Select the signed escrow group card in the top right panel.
  15. In the pop-up, click Export to download it locally.
  16. Send the signed escrow group file to a Super-Admin.

To Super-Admin​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click Escrow Certificates in the left panel.
  4. Click the Execute signed certificates button in the top right panel.
  5. In the pop-up, click Browse Files.
  6. Select the escrow certificate file from your local machine and click Open.
  7. To execute, click Apply.

Delete an Existing Escrow Group​

To Site-key Admin​

  1. Open Connect Application.
  2. Select your deployment card.
  3. In the login window, select the Site-key category.
  4. Click Load key on the login page.
  5. Open your site-key file from your local machine.
  6. Enter your account password.
  7. Click Login.
  8. In the site-key dashboard, click the Add escrow group button in the top left.
  9. In the pop-up, enter the escrow group name.
  10. Click Create Request.
  11. Under the New Escrow Group card, tick Sign to sign the group certificate.
  12. Enter your password in the top right panel.
  13. Click Sign all.
  14. Select the signed escrow group card in the top right panel.
  15. In the pop-up, click Export to download it locally.
  16. Send the signed escrow group file to a Super-Admin.

To Super-Admin​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click Escrow Certificates in the left panel.
  4. Click the Execute signed certificates button in the top right panel.
  5. In the pop-up, click Browse Files.
  6. Select the escrow certificate file from your local machine and click Open.
  7. To execute, click Apply.