If your key is stolen
Your hardware key has been stolen — or you have strong reason to believe it is compromised. The recovery flow is the same as for a lost key, with one critical addition: at the end, you revoke the stolen key so the thief cannot use it.
Move fast
A stolen hardware key is more urgent than a lost one. The thief, in principle, can authenticate to your vault until you revoke them. How long that window stays open depends on how quickly you can run the recovery flow.
If you suspect theft, run the recovery flow as soon as you reasonably can. You do not have to be at a specific device — any browser on any computer works.
What is the same
Everything in the lost-key flow:
- Bring your recovery code, your account email, and your verification material.
- Email support@clavitor.ai and join the Zoom call we send back.
- Pass human verification on the call, get a verbal session code.
- Enter session code and recovery code at clavitor.ai/recover.
- Register your new hardware key.
What is different
When you register the new key, the recovery page shows a checkbox: Remove the vault's other devices (a lost or stolen key stops working). It is ticked by default. Leave it ticked.
With the box ticked, registering the new key revokes every other device of the vault, the stolen key included. From that point on, the old key — even with a valid biometric tap — no longer opens the vault, and signing in with it is refused with 410 Gone: "this key was removed from the vault". The recovery code that belonged to the old key stops working too. The thief's key becomes inert.
The revocation is atomic with the new-key registration: both are written in one transaction. You never end up with the old key revoked and no working replacement, or with the new key registered while the old one still works. Either both happen, or neither does. If the step fails, nothing has changed, and you can register the new key again on the same page within the session's 10 minutes.
What revocation does not do
Revocation prevents future use of the stolen key. It does not undo past use.
If the thief had time to log into your vault before you ran recovery, they may have read whatever credentials your hardware key could decrypt. The encrypted data they pulled stays decrypted on their machine until they delete it — Clavitor cannot reach over and erase it.
If you suspect the thief saw your data, rotate the underlying credentials. Change passwords on the accounts that matter, regenerate API keys, replace SSH certs. Clavitor will continue to hold the new credentials safely; the issue is what the thief already learned.
A practical sequence
If you have just discovered theft, in roughly this order:
1. Buy a replacement hardware key, or pick up an existing spare.
2. Run the recovery flow. Leave Remove the vault's other devices ticked.
3. Register your new key.
4. Generate a fresh recovery code on Vault → Security.
5. Rotate any high-value credentials the stolen key could decrypt — bank accounts, email, work credentials, anything with money or access to other systems.
Steps 1–3 close the door. Steps 4–5 deal with whatever passed through it.