Administrators only. Code by e-mail, then two-factor authentication.
The master password is never asked on the web: it only opens the vault, in the app.