Team Collaboration

Teams bring assets, members, settings, and billing together. Members can browse unencrypted asset metadata while their personal identities are locked. Encrypted content is shared through asset-level recipient and guardian policies.

Personal identities across workspaces

Each member enrolls one personal age identity and protects it with their own unlock passphrase. That identity works across their teams; team creation needs no shared encryption phrase. Invitations bring people into a workspace without exchanging private keys.

Each team has one owner, who manages team settings, billing, invitations, and member removal. Invitations grant the Member or Admin role. Asset Custodians choose Successors and Gatekeepers separately from team roles. A team administrator does not automatically become a cryptographic recipient of every asset.

Shared responsibility without shared passphrases

Custodians and enrolled Successors receive encrypted content addressed to their public keys. Gatekeepers oversee access without receiving a key through that role. The server requires access approval before delivering ciphertext to a Successor. Because Successors are recipients in advance, an independently obtained ciphertext copy can be decrypted offline even before approval.

Owner escrow is off by default. Enabling it adds the owner's key to expected recipient sets, with existing assets flagged until an eligible member re-encrypts them. Escrow does not bypass server access checks and does not let the owner view assets in the app; it supports out-of-band recovery of ciphertext copies with the owner's identity backup. Disabling it cannot revoke copies already obtained.

Membership changes

A member who holds any guardian role cannot be removed until each Custodian removes their Successor and Gatekeeper roles; the asset is then re-encrypted without them. A Custodian's assets must be transferred to another member first, by the Custodian or, to someone who can already decrypt them, by the owner. Removal ends team API access. Neither removal nor personal identity rotation erases copies already downloaded.

Personal rotation stages every affected asset across teams and activates the replacement identity atomically. Inaccessible or undecryptable assets block it. Old shared-phrase teams migrate through the same payload-access gates, so an owner may need each asset's Custodian or an approved Successor to help.

Read Team Management for invitations, owner settings, migration, and the 72-hour deletion grace period. Read the Security Model for metadata visibility and encryption boundaries.