How do we store the credentials only one person knows?

Nearly every small business has credentials that live in one head or one personal account. The domain registrar. The bank. The accounting system. The Microsoft tenant, sometimes registered to a former employee's personal email. If that person is unreachable, the business is stuck, and that risk has nothing to do with anyone's trustworthiness.

What we set up:

• Business ownership of business accounts. Anything the company depends on should be registered to a company address, ideally a shared mailbox rather than an individual, so it survives that person leaving.
• The critical few in a vault the owner can reach. Not everything, just the handful that would stop the business: domain, banking, the tenant, the accounting system, the alarm.
• A break-glass path. Keeper supports emergency access, where a designated person can reach a vault after a waiting period. That covers the situation nobody wants to plan for.

The registrar is the one we push hardest on. A domain registered to a personal Gmail belonging to someone who left in 2019 is a genuine business continuity risk, and it is the kind of thing that surfaces at the worst moment, usually mid-outage.