Permissions on the Password Depot Enterprise Server control who may see and change which databases, folders, and entries. For DLP requirements (Data Loss Prevention), a second layer is decisive: the CE Client Policies of the Corporate Edition centrally define what the Windows client technically offers at all – for example whether exporting, printing, or storage locations such as OneDrive are available. This article shows how to combine both layers, how to ensure availability without uncontrolled "side copies" – and where the technical limit of any password manager lies.
Note: CE Client Policies only apply to the Windows client in the Corporate Edition; the Standard Edition does not support them.
The technical limit, upfront
As soon as a user is allowed to display or use a password, a TOTP secret, or any other secret in plain text, they can in principle also pass it on – by writing it down, taking a screenshot, or sharing it verbally. No password manager can therefore prevent exfiltration one hundred percent. The goal of a DLP configuration is to centrally close the typical technical exfiltration paths (export, printing, clipboard, external storage locations); the rest is a matter of your permission and operating model: plain-text access should be limited to those who genuinely need it.
Lever 1: Centrally define allowed storage locations (most important lever)
Under Manage → CE Client Policies → Allowed Storage Policy in the Server Manager, you define which storage locations the clients may use in addition to the Enterprise Server (e.g., Local System or cloud services such as OneDrive, Dropbox, Google Drive). Any storage location you disable here is not displayed in the client and therefore cannot be used to store databases outside the server.
Best practice: if data must remain server-side, disable external storage locations consistently.
Lever 2: Centrally block actions
Under Manage → CE Client Policies → Action Policy you allow or block, server-wide, functions that are typically used for exfiltration, including:
Copy data to clipboard
Print
Export
Read TOTP secrets – a policy added in the Corporate Edition, disabled by default.
Note on TOTP: This policy only controls read/display permission for the stored TOTP secret (the secret key) – it does not prevent the use of two-factor authentication as such.
In addition, the Program Options of the CE Client Policies include protective options such as Automatic cleaning of clipboard (data copied to the clipboard is deleted after the defined time in seconds) and Hide clipboard changes from external viewers.
Putting export into perspective
Via Tools → Export, the Windows client exports databases to the formats XML, CSV, TXT, HTML, or PSWE (Password Depot database). XML, CSV, TXT, and HTML do not support encryption – anyone with access to those files can read their content in plain text. PSWE exports, by contrast, are encrypted using the authentication method you are currently using. The export scope can be limited to a Selected folder (optionally including sub-folders); this refers to folders inside the database, not a target path in the file system. If exporting should not be possible at all: block the Export action via CE Client Policies and/or remove the Export entries permission via Server Policies or database permissions.
Availability and emergency access without a "shadow cloud"
Solve availability and emergency access via the intended server mechanisms – not via privately maintained parallel cloud databases:
Offline mode: Access to server databases when the server is temporarily unreachable. Prerequisite: under Manage → Server Policies, set Save database locally to Not defined or Enabled, and allow the corresponding right (Save local copy) at the database level for the users/groups concerned. The online help recommends leaving the server policy at Not defined and granting the right per database. You can limit offline usage in time under Manage → Server Policies → Security (Limit offline usage by time to, hours or days).
Server backups: Under Manage → Server settings → Backups, configure automatic backups (on every startup and/or at fixed intervals; recommended at least every 24 hours). Backups include databases, logs, and the configuration file
pwd_srv.cfg(users and settings); retention is configurable (number of backups 1–2,000, maximum age 1–72 months), optionally with a backup log.Server mirroring: Under Manage → Server Mirroring, set up a real-time replica (roles Principal and Mirror). Users can connect to the mirror but use it in read-only mode only; if the principal server fails, administrators activate the mirror as the new principal server.
Private databases on the server: Under Manage → Server settings → Additional, private databases can be created automatically for new users (and group databases for new groups). Private passwords thus remain under central policy, backup, and permission control instead of drifting into external cloud accounts.
Using permissions and Server Policies deliberately
Permissions particularly relevant for DLP – globally under Manage → Server Policies or per user/group via Databases → Permissions: Print entries, Export entries, Save local copy (prerequisite for offline mode), Share entries, Seal entries, and Set second password. Note: a permission disabled in the Server Policies applies to the entire server and cannot be re-enabled at the database level – use global disables sparingly.
Preventing circumvention via other clients
To prevent users from bypassing the CE Client Policies by installing the Standard Edition, go to Manage → Server settings, section Connections → Supported clients, and allow only the Corporate Edition for Windows to connect to the server.
Three best-practice profiles
Profile 1 – Maximum protection (server data must not leave the company):
Allowed Storage Policy: Enterprise Server only; disable all other storage locations.
Action Policy: disable Copy data to clipboard, Export, and Print.
Program Options: additionally enable Automatic cleaning of clipboard and Hide clipboard changes from external viewers.
Availability: allow offline mode only selectively per database/group and limit it in time; automatic server backups; server mirroring for high availability requirements.
Profile 2 – Balance (reduce risk, keep operations workable):
Storage locations: Enterprise Server, plus Local System only if genuinely needed.
Actions: disable Export and Print; allow the clipboard, but with Automatic cleaning of clipboard.
Offline mode: enable selectively for mobile users and limit it in time.
Server backups: daily, with clearly defined retention.
Profile 3 – Separate worlds (business and private, without shadow IT):
Company data: apply Profile 1 or Profile 2, depending on protection requirements.
Private passwords: do not let users drift into external cloud solutions; instead, create private databases automatically on the Enterprise Server (see above).
Warning: CE Client Policies always apply server-wide to all users – differentiation per user, group, or database is not provided for. Therefore plan and test the configuration before enabling it, e.g., in a test installation.
Related topics:
Corporate Edition: Managing Client Security Policies Centrally
Why are the Client Security Policies not applied on the client?
Assigning Enterprise Server permissions correctly – and why users still cannot see entries
Server backups: set up, change location, restore – and emergency access in case of server failure
How can I access server databases using the offline mode and which settings are required to do so?