Team Management

Teams organize assets, members, and billing. Team roles control administration; asset guardian roles control access to encrypted content. Joining a team makes its asset metadata visible, but does not give you a decryption key for every asset.

Create a team

1. Choose Create a new team from the team dropdown.
2. Enter a Team name and Team URL, and optionally add a logo.
3. Select Create team.

Team creation does not ask for an encryption phrase or reminder. On your first team visit, create your personal vault identity with an unlock passphrase of at least 12 characters. Download its raw identity backup and keep it private. Use the same personal identity across your teams; do not share your passphrase or backup with teammates.

Invite and manage members

From Team Settings → Members, invite a member by email as a Member or Admin. Each team has exactly one owner, the account that created it; ownership cannot be granted by invitation. The recipient accepts the invitation and enrolls their own identity. Invitations, member removal, billing, owner settings, and deletion are owner-only operations.

Review pending invitations and member roles regularly. Adding a member does not add them to every asset's recipients. The asset Custodian assigns Successors and Gatekeepers separately. See Guardian System.

A member cannot be removed while they hold any guardian role in the team. Removal is refused with a message listing their roles and how many assets are affected. Each asset's Custodian must first remove that person's Successor and Gatekeeper roles; removing a Successor may need another Successor's approval, and the asset is then re-encrypted without them. If the member is the Custodian of any asset, transfer those assets first: choose Transfer their assets to… on the member, or Transfer Custodian on a single asset. An owner can only transfer an asset to someone who can already decrypt it, such as an enrolled Successor; otherwise the current Custodian must make the transfer themselves, which re-encrypts the asset for the new Custodian. Assets that could not be transferred are listed with the reason. The team owner cannot be removed.

Once removed, the person loses team API access. Removal cannot erase plaintext or ciphertext copies they already obtained.

Edit owner settings

1. Open Team Settings.
2. Update the team name, logo, or Owner escrow setting.
3. Enter the existing name under Confirm current team name.
4. Select Save Changes.

Owner authorization and name confirmation apply whether your personal identity is locked or unlocked. The team URL remains read-only. No encryption hash is used as proof of authority.

Owner escrow

Owner escrow is off by default. When enabled, the owner's personal public key is included in every asset's expected encryption recipients. This is a backup-recovery measure, not an in-app access path: the app still delivers ciphertext only to the Custodian and approved Successors, so an owner without a guardian role cannot view the asset in Key Man Out. After re-encryption, a ciphertext copy obtained outside the app (for example from a data backup) can be decrypted with the owner's identity backup and the age CLI.

Changing escrow does not rewrite assets immediately. It flags encrypted assets for an eligible unlocked user to re-encrypt. Disabling escrow cannot revoke the owner's previously obtained copies. See the Security Model before changing this setting.

Migrate a legacy team

An owner can start legacy migration from settings while the team shows migration is needed. Enter the old team phrase only in the browser. The browser converts accessible AES-GCM secret and attachment contents to age ciphertext.

Ownership alone does not unlock other people's assets. Every migration payload read requires the same guardian access approval and sends the same notifications as ordinary access. Blocked assets are reported without exposing ciphertext. Ask eligible Custodians or approved Successors to migrate their assets, then finalize as owner after no legacy payload remains. Missing identity enrollment leaves assets flagged for subsequent re-encryption.

Legacy hashes and reminders exist only as internal migration markers until finalization; new teams do not have them. See Migration limitations.

Schedule or cancel deletion

1. Open Team Settings → Danger Zone.
2. Select Delete Team.
3. Enter the exact team name and select Schedule Deletion.

Deletion is scheduled for 72 hours later. During that period the team remains accessible. To cancel, return to settings, confirm the current team name, and select Cancel Deletion. Both actions require the owner account, not an unlocked identity.

After the grace period the team and its stored assets are permanently deleted. Keep any necessary backups before scheduling deletion.

Work across teams

Use the team dropdown to switch workspaces. Each team has separate members, assets, settings, and billing. Your personal identity unlock is shared across your teams in that browser session and expires 30 minutes after unlock. Personal identity rotation belongs in Account Security, not team settings.