The situation
The group chat is the vault.
In most small businesses the real credential store is a message thread. Someone asked for the Wi-Fi password in 2021 and the answer is still there, along with the supplier login and the code to the back door.
That thread outlives the people in it. Anyone who was ever in the team can scroll back, and nobody is going to audit it.
The fix is not enterprise software. It is deciding that shared access lives on an object that stays in the building, and that leaving the team means leaving the object behind.
A working setup
One card per place, not per person.
-
I
Front of house
A card in the safe with what the floor staff need. Nothing financial.
-
II
Back office
A card kept by whoever runs the accounts: banking, payroll, supplier portals.
-
III
Owner's copy
A card that carries everything, kept away from the premises.
-
IV
When someone leaves
Rewrite the card they could reach and change what was on it. One task, one afternoon.
Turnover is normal.
Standing access is not.