Guides

Notifications

Every email and in-app alert CredenShare produces, who receives each one, what you can turn off, and the events that notify nobody.

CredenShare notifies you about very little on purpose. This page lists everything it does send, and the things people most often assume it sends.

A share emails you about its activity only if you asked when you created it: Email me when in the create dialog offers four events (opened, refused access, expired, deleted by someone else), all unticked by default. See Creating a share. There is no in-app notification and no push for any of them; the bell in the top bar will not light up.

Two ways to find out without an email:

The access trail. Open a share from your Shares list to see every access attempt with its timestamp, IP address, platform, user agent, and whether a password attempt failed. It exports as CSV or JSON. How far back you can read it depends on your plan: Solo 3 days, Basic 7, Plus 30, Business 90, Enterprise 180. Free accounts have no retention window. See Key concepts.
Webhooks, for programmatic notice. share.viewed fires to your endpoint on every successful open, alongside share.access_denied, share.expired and share.deleted. Requires Business or Enterprise. See Webhook events.

When a recipient uses up the failed-password tolerance, the share is permanently destroyed. You are emailed only if you ticked It expires; the recipient is not told. See Creating a share.

In-app notifications

The bell in the top bar has exactly one producer: a submission arriving on one of your secure requests. Nothing else in the product writes to it.

The notification reads:

New response submitted by <submitter> for request <request title>

<submitter> is the submitter's account email address, or the literal word guest when the person who filled the form was not signed in. Clicking the notification marks it read and takes you to that request's page, where the submissions are listed.


Fires when	Someone submits an answer to your secure request
Goes to	The request owner only — never the submitter, and never other team members
Requires	Secure requests, which are Business and Enterprise
Configurable	No. The in-app notification is always written, whether or not the request's email toggle is on

The bell polls every 30 seconds while the panel is closed, so a new submission can take up to half a minute to appear. It does not push.

Working the list

The panel shows 10 notifications per page, newest first, with the unread count on the badge (capped at 99+ in the display, not in the count). Mark read marks the unread items on the page you are looking at. Clear empties the list in your browser only — the records stay on the server, and they come back the next time the panel refreshes. There is no way to delete a notification.

Emails

The emails below are transactional. The optional service-update and newsletter mail is separate — see Communication preferences.

Email	Sent to	Configurable
Sign-up verification code	The address registering	No
Password-reset code	The account's address	No
Security code to start changing your sign-in email	Your current address	No
Confirmation code for your new sign-in email	The new address	No
Notice that your sign-in email was changed	Your previous address	No
Notice that a change to your sign-in email was stopped because it skipped the steps in Change email	Your current address	No
Sign-in code, when email is your two-factor method. The same email carries the code when the Confirm it's you window asks for an email code	The account's address	Turned off by disabling Email MFA in Account → Security
Team or account invitation, with the link to accept	The invited address	No
A submission arrived on your secure request	The request owner	Yes — see below
Your share was opened, refused, expired or deleted by someone else, for the events ticked under Email me when	The share's creator	Yes, per share, when it is created. Off by default

Someone invited who has no CredenShare account gets an email with only the acceptance link, which asks them to accept the invitation and create their account; the link opens a form where they choose a password. Invitation links expire 24 hours after the invitation is sent. Before October 23, 2026, someone invited to a team who had no CredenShare account got an email carrying two links: the invitation link, and a link to a CredenShare share titled "Your login information", holding their email address and a generated password. Sending the invitation creates the account with that password, and the password is permanent. The share can be opened for up to 7 days after the invitation and closes five minutes after it is first opened, whichever comes first. It closes early if the invitation is cancelled, the invitee is removed from the team, or the team is deleted. If it closes before the password is saved, the invitee sets a new one with Forgot password? on the sign-in page. Invitation links expire 24 hours after the invitation is sent, and a resend carries only the invitation link. An account-only invitation (sent from Members with no team ticked) carries no login link or password; when it created the account, its email asks the invitee to choose a password first, on the password-reset page with the invited address.

CredenShare does not email a share link to your recipient. Shares created in the app produce a link for you to copy and deliver yourself. Shares created through the Slack app are the exception: the CredenShare app messages the recipients you selected in Slack directly — see Slack integration.

Turning off submission emails

A secure request has a per-event email switch, and so does a share (Email me when, above). When you create or edit one, Notify me on submission controls whether each submission emails you:

Send you an email each time someone submits to this request. Use sparingly for high-volume forms — the notifications hit the inbox you signed up with.

It is on by default, it sends to the address on your CredenShare account, and its current state is shown as Email Notifications on the request's detail page. Turning it off stops the email only; the in-app notification is still written and the submission still appears on the request.

Communication preferences

Account → Profile carries a Communication preferences block with two independent checkboxes:

Setting	Covers	Default
Service updates	Feature releases, status notices and information relevant to your subscription	On
Newsletter	Security tips and product news. Marketing, and opt-in	Off

Neither affects the emails in the table above. As the panel itself puts it: "These do not affect essential mail — password resets, verification codes, share notifications and invoices are always sent."

You are asked to set these once, by a one-time prompt headed What may we email you about?, and can change them at any time from the same block.

What produces nothing at all

None of the following notifies anyone, by email or in-app:

A share being viewed, expiring, being deleted, or being destroyed by failed password attempts, unless you ticked that event under Email me when when you created it
Approaching or exhausting your share allowance
A share you own nearing its expiry — there is no expiry reminder of any kind
Someone accepting your team invitation
A member being removed from a team
An API key being created or revoked, or a device being linked under zero-knowledge custody
Anything at all reaching a submitter after they fill in a secure request form

Most of these do have a webhook event, on Business and Enterprise — including org.member_added, api_key.created, zk.device_linked and user.emergency_expire. If you need to be told, wire up an endpoint: Webhook events.

Webhooks are the only way CredenShare pushes events to a system of your own. There is no email digest, and no way to have CredenShare email a third party on your behalf. If you would rather poll than receive deliveries, GET /v1/stats returns your account's share counts and a 14-day view history in one call.

One more thing about email

The in-app Enterprise Contact Us form relays your message to CredenShare; you are not copied on it, so keep your own note of what you sent. For anything else, write to support@credenshare.io.

SecurePaste

The public paste tool at paste.credenshare.io — no account, no plan allowance, a fixed 24-hour expiry and a link that opens once by default. Plus the signed-in version and what it adds.

Signing In

Creating an account and verifying it, signing in with a password or with Google, changing your sign-in email, two-factor authentication, trusted devices, password resets, automatic sign-out, and what to do when you are locked out.