Your journal holds the details of your notarial work. Vault protection helps you keep those contents encrypted and gives you control over unlocking them. Use it as an individual notary or alongside your team—each notary keeps their own journal keys and passphrase.
How Vault protection helps you
- Keep journal contents encrypted. Entries you finalize with Vault protection are stored as encrypted copies, and you unlock them in the separate secure viewer.
- Control access with your own keys. Your journal passphrase unlocks your protected key. Keep the matching recovery kit so you have another way to regain access if you forget that passphrase.
- Use it independently. Turn protection on for your personal account without joining an organization or connecting an external system.
- Use it with your team. A team can follow a shared protection requirement while each notary keeps their own keys, passphrase and journal.
Start with your personal setting and key setup below. Team requirements and external integrations are covered later in this guide.
What gets encrypted
For entries you create in Journal, Finalize encrypts the journal contents on your device before sending the protected copy to NotaryCentral. The server stores encrypted contents alongside metadata needed to identify and manage the entry, such as its owner, commission, date and fee. Your journal passphrase and unwrapped private key stay in the separate secure viewer.
This protection does not make all account or entry metadata invisible. It also does not remove earlier records or protect a PDF after you download or share it.
Turn Vault protection on or off
In the web app, open Journal → More → My Vault keys. The Vault protection toggle shows the saved setting for your personal account.
- On: new journal entries use your personal Vault. If setup is needed, complete account verification, create a key in the secure viewer and save its recovery kit privately.
- Off: new entries are saved without Vault encryption. Your existing keys and encrypted entries are kept; you still need the original key and passphrase or recovery secret to open those entries.
Drafts save automatically. Creating another key does not itself turn protection on, and changing the toggle does not re-encrypt earlier entries.
Know which key an entry uses
My Vault keys lists your key names, current or earlier status, and Added to your account dates. That date is the registration timestamp, not proof of when a key was originally generated. Expand key details to see its ID and UTC timestamp.
Choose Create new key, complete any account verification, then choose Open secure setup. Choose a readable key name, enter your private journal passphrase and save the recovery kit in the secure viewer. New Vault entries use the new key. Earlier entries keep their original key.
The secure viewer shows the name of the key used by the entry you are opening. Creating a replacement key does not recover an older key or unlock its entries.
Keep your recovery kit private
Your NotaryCentral account login and your private journal passphrase serve different purposes. Signing in verifies your account; the journal passphrase unlocks your protected key. Use the matching private recovery secret if you forget that passphrase.
Keep each recovery kit somewhere private and accessible to you. Do not send passwords, recovery secrets or private-key material to an administrator or support. Without a usable passphrase or recovery material for the original key, a new key cannot restore access to its encrypted entries.
Using Vault protection with a team
An organization can require Vault protection for its notaries. When that applies to your account, My Vault keys states the requirement directly and keeps the toggle on. Each notary still controls their own keys and journal passphrase.
Your administrator can manage the organization’s requirement. They do not need your passphrase or recovery secret. Without a required policy, you choose your own personal setting.
Agree on access and responsibilities
An external-custodian integration is a separate workflow: the custodian encrypts the personal contents for the assigned notary and retains its source record. A company portal may require its own login. An organization role does not grant access to another notary’s passphrase or private key.
Arrange a safe place for each notary's private recovery kit and agree with the integration team on access, retention and exports. Use the role guides for this workflow.