FAQ

Before you move your team to Kestrel

The questions security and IT teams ask us most, answered by the people who build Kestrel.

Can Kestrel see our passwords?: No. Each vault is encrypted with AES-256 on your own device before it syncs, and only your master password can unlock it. We never hold the key.
How do we move from another password manager?: Import a CSV export from any password manager or browser. Folders, notes and one-time codes come across, and most teams finish in under ten minutes.
What happens when someone leaves?: Remove them in Admin → Members and their access to shared vaults ends at once. Items they created stay with the team, with a log of what they opened in the last 90 days.
How is Kestrel billed?: $4 per member a month billed yearly, or $5 billed monthly. Add or remove members whenever you like and we prorate the difference on the next invoice. Compare plans.
Do you support single sign-on?: Yes, on the Business plan: SAML sign-in with Okta, Microsoft Entra ID or Google Workspace, and SCIM to add and remove members automatically.
Has Kestrel been audited?: Every year. Our SOC 2 Type II report and the 2026 penetration test by an independent firm are available under NDA. Request the reports.

More answers in the help center, or talk to our security team.

FAQ Answer Grid