Xiora Apps
Back to all posts
Blog6 min read

Make shared and corporate password rotations visible.

Personal passwords can hide inside a password manager. Shared business SaaS accounts and family-shared logins are different — when no single person owns rotation, it slides. Surfacing 'when was the last rotation, when's the next one' is the missing piece.

Why shared rotations slide

Shared accounts assume someone will handle it, and that someone often turns out to be no one. Long-lived sessions on multiple devices make the switch feel disruptive, so it gets postponed indefinitely.

  • Last rotation date is unknown
  • Unclear who currently has the password
  • Impact radius (linked apps, autologins) feels risky
  • It never wins against day-to-day priorities

Default cycle: 90 days for sensitive, 6-12 months otherwise

High-impact shared accounts deserve a quarterly rhythm. Others can sit on six-month or annual cycles. Kigen records the last-rotated date and a target next-rotation date for each, with a quiet nudge as the date approaches.

Before rotating, take stock of who and where

Changing a password means re-authenticating on every active session. Knowing in advance which devices and people are currently logged in prevents the post-rotation chaos. Kigen lets you note the current device-and-person list against each account.

  • List devices and owners affected
  • Reissue MFA recovery codes
  • Identify integrations that need re-auth

Rotate immediately on departures or transitions

When the group of people with access changes — an employee leaves, a contract ends, a household changes — the password should change that day. Logging the 'last accessor' beside each account makes these transition moments hard to miss.

Don't store the password itself

Kigen is not a password vault. Specialized vaults are better at storing secrets; Kigen handles the metadata — when to rotate, who knows it, what's the next scheduled date. Splitting the responsibilities makes the rotation cadence stick.