Prepare ECE recovery codes before normal secret access is lost

Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.

Source facts

Verkada ECE recovery codes provide another way for a user to decrypt the customer secret when normal access is unavailable. An account-specific code is emailed after the user accepts an invitation and sets a password, and remains valid until rotated or the account is deleted. An authorized Org Admin can send a new code, which invalidates the old one. Managing recovery codes requires access to the current customer secret and a validated administrator recovery code.

Source: Verkada Help — Enterprise Controlled Encryption Account Recovery.

Applicability

Applies to ECE account recovery in Verkada Command. A recovery code is distinct from an organization invitation, and this article does not guarantee recovery when all required key access has been lost.

DSE recommendation

DSE recommends completing recovery-code onboarding while normal access works. Have each user store the code in an approved protected location and identify a trained administrator who has validated their own recovery path. Record readiness without collecting users’ codes into a general spreadsheet. Include recovery-code rotation when assessing a suspected disclosure and update the recovery instructions afterward. Do not wait for the only knowledgeable administrator to be locked out before discovering the prerequisite.

Verification

Use a disposable or explicitly approved test account to rehearse the documented recovery flow. Confirm the replacement code arrives through the intended channel and that the old code is invalidated when rotated. Keep the outcome and responsible owner in the record, while excluding code values and decrypted key material.

Official reference

Verkada Help — Enterprise Controlled Encryption Account Recovery. Reviewed October 15, 2026.