Recovery, emergency kit, and device handoff

When you sign in on a new or wiped browser, you need a way to load your encrypted workspace keys onto that device. This guide walks through every recovery and handoff option in the order InviziPoll tries them.

#Your ways back in

When you sign in somewhere your keys aren't loaded, InviziPoll tries these, roughly in this order.

This browser

By default a browser you've used before keeps an encrypted copy of your keys, protected by your operating system account, so you unlock without extra steps. You control this under My Account → Security with Keep me signed in on this browser and Require passkey to unlock on this browser.

Your inbox and password

On a new device you land on Verify this device. Choose Send verification code and we email a 6-digit code to your account address. Entering it proves you control the mailbox and releases your encrypted key backup to that browser; you then enter your password (or your recovery key) to open it. Your key backup is locked in your browser before it reaches us, with your password or your recovery key. Nothing we store can open it. Your recovery key never reaches us at all. The Threat model explains why.

Your inbox alone isn't enough: you'll also need your password or recovery key. If you reset your password, the old password stops opening the backup, but your recovery key still does, and the backup is locked again under your new password once you're back in. After you verify, you can choose to trust that browser for 30 days, so you skip the email code there (you still need your password or recovery key); those browsers are listed under My Account → Security → Browsers that skip inbox verification, where you can remove them.

Your recovery key

Under Settings → Backup & Recovery, Your recovery key saves a key that unlocks your key backup on a new device if you forget your password. If your account signs in without a password (single sign-on, or a passkey only), it's the only thing that does, so you're asked to save one (Save your recovery key) before you can use the admin console. For an owner, the recovery key is the workspace's emergency recovery kit key, described below.

Another device (device handoff)

One of your own devices that's already unlocked can approve a new one. On the new device choose Start approval request under Trusted-device approval, then approve it from Approval Queue in the sidebar on your other device. Only your own devices can approve: nobody else, owner or admin, can approve a device for you, because their approval would hand over their keys, not yours. We pass the keys along encrypted for the new device; you approve each transfer yourself.

A workspace owner

If you can't open your backup and don't have another signed-in device, choose Ask a workspace owner on the same screen. You read the code on your screen to an owner by phone or in person, they type it in, and their browser restores exactly the workspace access you had before, nothing more. An owner can restore a colleague's access only after confirming a code with them directly; we can't do it for them. Anything that was only in your personal folders stays locked. See Restoring a teammate's access.

A passkey

If you've added a passkey that supports the PRF extension, Sign in with Passkey on the sign-in page can unlock your keys too. A passkey saved to iCloud Keychain or Google Password Manager goes further: it syncs to your other devices and opens your key backup on any of them, with no password to remember.

To add one, use the Add a passkey card under Settings → Backup & Recovery, or My Account → Security. The card shows when your browser can make a passkey and you don't have a synced one opening your backup yet. Some passkeys, like Windows Hello, can sign you in but can't open your key backup, so keep your recovery key or kit as well. See Passkeys and trusted devices.

A recovery file

Under Settings → Backup & Recovery, Offline recovery file → Download recovery file saves an encrypted copy of your keys, protected by a password you choose. The file is named InviziPoll_Workspace_Recovery_*.json. We don't keep a copy of the file, and the password isn't sent to us.

To use it, open Recover workspace keys → Import backup file (.json) and enter that password. Restore from this browser appears when this browser holds a saved backup. Older InviziPoll_Backup_*.json files still import.

The emergency recovery kit

Owners are offered a recovery kit while setting up a workspace (Save your recovery kit). It downloads InviziPoll_Recovery_Kit_*.json, which contains a Recovery Key. That key is also your own recovery key, so it unlocks your key backup as well as the workspace. With the kit you can unlock the workspace even if you've reset your password or lost access to your email. Replace recovery kit makes a new key, and the old kit stops working. If you lose both the kit and every other route, we can't recover the keys for you.

Starting fresh

If none of these work, Start fresh with a new key gives your account a new key once you type start fresh to confirm. Anything only your old key opened stays locked unless an owner restores your workspace access afterwards. If you're the only owner, nobody can, so your old polls and results stay locked for good.

#Which recovery option to keep

• Everyone: your password (or your recovery key, if you sign in without one), a protected mailbox, and at least one other device or a passkey.
• Owners: the recovery kit, and a recovery file and its password, stored somewhere other than your laptop: a password manager or a printed copy in a safe place. If you're the only owner, add a second one, because nobody can restore an only owner's access. Until you do, a banner reminds you: it asks for the recovery kit first, and once the kit is saved, it suggests adding a passkey where your browser can make one.

#Recovery file details

Newer files carry the workspace name and a timestamp on the outside and an integrity check, so a damaged file is caught before you type the password. A failed check means the file is corrupted, not that the password is wrong. If you import a file from another workspace you'll get a warning, and you can continue if that's intended.

If you see a "last downloaded" hint, it's a reminder stored in this browser, not proof we hold your file.

#Before you turn on SSO

SSO setup asks the owner for two things first: password sign-in on their account, and a recovery export on record. Downloading a recovery file here (or saving the recovery kit during setup) satisfies the second. SSO is on Business and Enterprise, or during a trial with the Business features preview on. See Single sign-on (SAML & OIDC).

#Where things live

• Settings → Backup & Recovery: your recovery key or recovery kit, and recovery file download and import.
• Approval Queue: approving your own new devices and, for owners, access requests from your team.
• My Account → Security: passkeys, two-factor authentication, this browser's unlock settings, vault idle lockout and trusted browsers.
• Admin → 2FA: the two-factor policy for the whole team.

#Related

• Threat model
• Restoring a teammate's access
• Passkeys and trusted devices