Security Standard

SEC-004 — Credential Backup & Recovery

Defines protected primary and offline recovery copies, annual testing, and the emergency account-recovery sequence.

Document: SEC-004Type: StandardStatus: ApprovedOwner: Cloudberrie LeadershipVersion: 4.2.0Updated: 2026-07-17

Recovery Objective

Cloudberrie must be able to recover access to critical infrastructure if the primary Mac, browser session, authenticator, or administrator is unavailable.

Required Copies

Copy	Location	Contents
Primary	Apple Passwords	Credential, account identity, recovery codes and notes
Secondary	Encrypted offline storage in a physically secure location	Tier 1 recovery codes and emergency ownership references
Not permitted	Email, unencrypted cloud drive, screenshots or chat	Any usable secret

Recovery Test

At least annually, and after major account changes, verify:

The protected entry can be opened Recovery codes are still valid or have been refreshed The authorized owner can identify the correct login URL The offline recovery copy is readable and secure

Emergency Sequence

Use the official platform recovery process.
Verify the legal and operational owner before changing access.
Reset the password and MFA factors.
Revoke unknown sessions and tokens.
Document the event without recording secrets in the manual.
Replace stored recovery codes after use.