Team

Profiles belong to a workspace, not to a person. A team workspace lets several accounts use the same profiles, organised by team folders and controlled by roles.

Teams are included on the 50-, 200- and 1,000-profile plans. The Free and 10-profile plans have a single member and no team screens; extra seats add devices but never add teams to a plan that does not include them. See Accounts and plans.

Membership and invitations are administered in the web account (Workspace) and in the desktop app (Team). Device-key enrollment, ownership transfer and recovery exist only in the desktop app, because they need keys that never leave your computer.

Roles

Role	What it can do
Owner	Everything: workspace, billing, folders, members, keys, recovery, ownership transfer, profiles, sync, export and deletion. One per workspace.
Manager	Profiles and folders, folder grants, members below manager, invitations for operators and starters, and device-key enrollment. Cannot change another manager or the owner, cannot touch billing, recovery, ownership, workspace keys or workspace deletion.
Operator	Profiles in granted folders: create, edit, move, sync, run, and explicit cookie import, export and clear. Cannot manage members, folders, keys or grants.
Starter	In granted folders: list profiles, download them, run them and commit the state a run produces. Cannot create, rename, move or delete profiles or folders, invite, manage keys, start a cross-workspace transfer, or use cookie, proxy and profile export.

Owners and managers see every team folder. Operators and starters see only the folders they were granted; a profile in no folder is owner- and manager-only.

Roles and folder grants are enforced by the account service on every request. They are protection against mistakes and ordinary misuse, not cryptographic isolation: every enrolled member holds the workspace key, so anyone who has legitimately downloaded a profile can keep what they decrypted. Removing a member stops new access immediately, but data they already downloaded cannot be recalled.

Inviting a member

Owners and managers create invitations in the web account (Workspace → Invitations) or in the desktop app (Team → Invitations → Invite member). An invitation carries the email address, the role and the team folders that person will be able to reach.

1. The account service emails the invitation link. Creating an invitation does not confirm that the email was delivered.
2. The invited person needs an Ant0 account on that exact address. Accounts are created only on the website; there is no sign-up in the desktop app.
3. They accept with the link, or by pasting the 43-character token into Team → Accept invitation.

Invitations expire after seven days, can be used once, and can be revoked with Revoke invitation. One invitation can be pending per email address per workspace. A workspace can hold 100 pending invitations; invitation creation is limited to 20 per workspace per hour and 5 per email address per day.

A new member is Needs key until an owner or manager enrols their device in the desktop app (Sync → Access → Give access) and that device confirms. Until then the member can see workspace and folder names but cannot download, run or commit a synced profile. See Sync.

Seats and devices

A seat is a member. The number of seats is the plan’s included seats plus any extra seats bought in billing. Each seat allows two active devices, and a device counts as active if it reported in within the last seven days. The desktop app and a signed-in web account browser both count.

Accepted members consume seats, including members that are still Needs key. Pending invitations do not. When the workspace is full, an invitation fails with the number of seats used; remove a member or buy extra seats first. Extra seats cost $5 per month or $50 per year, on the plan’s billing interval.

Team folders

Team folders group profiles and are the unit of access for operators and starters. Owners and managers create them with Create team folder, rename them with Rename team folder, and delete them with Delete team folder. Deleting one asks where its profiles should go — another team folder, or unfiled — and removes the grants that pointed at it.

A workspace can hold 1,000 team folders.

Grants are edited with a member’s role (Change access) or chosen when the invitation is created. A member with no folder selected has no access to profiles.

Removing a member

Remove member ends that person’s workspace access at once: their role, their folder grants and their profile leases all go, and their device envelopes are deleted. Any download link already issued to them stops working within ten minutes. To protect future revisions from a member you no longer trust, rotate the workspace key as well.

Transferring ownership

Ownership moves only through Team → Ownership in the desktop app; there is no way to change a member’s role to owner.

1. The current owner chooses Hand over ownership and an active member whose device keys are ready.
2. That member receives a time-limited link, valid for seven days. The current owner stays owner until the transfer completes, and can Cancel hand-over until then.
3. The target accepts in their own desktop app. Ant0 finishes the transfer and asks them to save new recovery material; the recovery code is shown in the desktop app only.

When acceptance completes, the former owner becomes a manager. Only one ownership transfer can be pending at a time.

When a plan lapses

A workspace whose paid service has lapsed becomes Retained read-only. Member rows and grants are kept but disabled, and only the owner can act: list and download the current encrypted profiles, and use recovery to decrypt them. Nobody can run a synced profile, upload, change workspace metadata or enrol a new device.

Retained data is kept for six months from the day the plan lapsed. Paying before that point restores the workspace without losing anything. Members come back in the order they joined, owner first, up to the seats the new plan provides; any beyond that stay disabled until seats are available.