Ask an Altru admin where the shared passwords live and you’ll often get an awkward pause, followed by “there’s a spreadsheet,” “there’s a binder in the box office,” or “our longtime box office manager knows them.” That works until that person leaves, the binder walks off, or the spreadsheet gets forwarded to a seasonal hire’s personal email.
The fix isn’t complicated, but it starts with a distinction many teams skip: some credentials should be shared through a proper vault, and some shouldn’t be shared at all.
Start by sorting your credentials into three piles
1. Altru user logins: don’t share these
Altru users sign in with their own Blackbaud ID. Each person who works in Altru should have their own login with a security role that fits their job. A shared “frontdesk” login looks convenient, but it erases your audit trail. When a refund, a discount, or an edited membership date shows up later, you want to know who did it, and that history only means something if each person signed in as themselves.
Individual logins also make offboarding a single step: disable the departing person’s access and you’re done, instead of changing a shared password and re-teaching it to everyone else at the desk.
If licensing is the reason people are sharing logins, take that up with your Blackbaud account contact rather than working around it. Sharing one person’s login may conflict with your license terms, so it’s worth confirming with Blackbaud rather than assuming.
2. Genuinely shared accounts: put these in a team vault
Plenty of accounts around an Altru shop really are shared by design. Typical examples:
- Your payment processor or merchant account portal
- The website CMS and hosting control panel where your ticketing and membership pages live
- Your email marketing platform
- Social media accounts
- Vendor portals for receipt printers, card readers, and other hardware
- Wi-Fi networks used by box office or event devices
- Any service accounts used by integrations that read from or write to Altru
These belong in a password manager with shared team vaults, not in a document.
3. Device and kiosk access: document it, but limit who sees it
Box office PCs, ticket-scanning phones, and kiosks often have local device passcodes. Staff need them, but they don’t need every other credential in the building. Keep them in their own vault folder that front-line staff can open, separate from finance and admin credentials.
What a good shared-password setup looks like
Any reputable business password manager will do the job. Rather than recommend one, here’s what to look for when you choose:
- Shared vaults with permissions. You should be able to give the box office access to one collection and the development team access to another.
- An organization account, not personal accounts. The vault should belong to the institution so it survives staff turnover.
- Activity logs. You want to see who viewed or changed a credential.
- Two-factor authentication on the vault itself. The vault is now the most valuable thing you have, so protect it accordingly.
- A browser extension and mobile app, so people actually use it instead of copying passwords into sticky notes.
Places shared passwords should never go
Inside Altru. It can be tempting to stash a vendor login in a constituent note, an attribute, or an organization record for the vendor. Don’t. Altru data gets exported, queried, and shown in places you don’t fully control, and those fields weren’t built to protect secrets.
Spreadsheets and shared drives. Even with restricted sharing, files get downloaded, synced to personal laptops, and emailed as attachments.
Email and chat. If someone needs a credential, share it through the vault. Messages sit in inboxes and chat history indefinitely.
Printed sheets at the desk. If a device passcode has to be posted, post it inside a locked drawer, not on the monitor.
Rolling it out without a revolt
- Inventory first. Go through the old spreadsheet, the binder, and your own browser’s saved passwords. List every account, who owns it, and who actually uses it.
- Name an owner for each account. Someone has to be responsible for rotating the password and removing access when people leave.
- Change passwords as you move them. Assume anything that lived in a spreadsheet has been seen by more people than you think. Migration is the natural moment to rotate.
- Turn on two-factor wherever it’s offered, and store the backup codes in the vault, not in someone’s inbox.
- Delete the old copies. Shred the binder, delete the spreadsheet, and empty the trash folder. Two sources of truth means the old one keeps getting used.
- Add the vault to onboarding and offboarding checklists, right next to creating or disabling the person’s Altru access.
The offboarding test
Here’s a simple way to know whether your setup works. Imagine your longest-tenured box office lead resigns tomorrow. Could you, within an hour:
- Disable their Altru access?
- Remove them from the password vault?
- List every shared credential they could see, and rotate the sensitive ones?
If the honest answer is “probably not,” that gap is what to close first. If your organization has an IT provider or a security policy that already covers this, loop them in early. They may have a preferred tool, and the Altru-specific piece is really just making sure individual logins and shared vaults stay separate.
Quick answers
Does Altru have a built-in place to store passwords?
Not one designed for it. Altru is built to manage constituents, sales, and memberships, and its notes and attributes aren’t meant to protect secrets. Use a dedicated password manager.
Is it okay for volunteers to share one Altru login?
It’s better to avoid it. Shared logins remove accountability for transactions. If cost or licensing is the obstacle, talk with Blackbaud about your options before setting up a shared account.
