Members, Roles and Seats

Everything an owner or an admin needs to run a team's roster.

Two screens manage people. Members is account-wide: everyone across every team you own, with the seat count. My Teams → a team manages one team's list and is where roles are changed. The Members tab only appears on a plan that includes teams — Basic and above. Free and Solo have no team support; someone on Free or Solo who has been invited into another person's team keeps My Teams but never sees Members.

Inviting someone

From Members, click Invite Member:

1. Enter one email address.
2. Tick the teams to add them to. Every team you own is ticked by default.
3. Click Continue. The app previews the seat cost.
4. On the Confirm Invitation step, click Confirm & Send.

Leaving every team unchecked invites the person to your account only. They are listed as Pending until they accept the invitation, and either way they reach no team data until you use Assign teams on their row. That sends one team invitation per team you pick, and they occupy a seat once they accept one. An invitation to an address with no CredenShare account, account-only or to a team, creates no account: its email asks them to accept the invitation and create their account, and the link opens a form where they choose a password. (An account-only invitation sent before October 23, 2026 did create the account, and its email asked them to choose a password on the password-reset page first.) On Members, an address with no account is listed once, even if several of your teams invite it. Ticking several teams sends one invitation email per team, each with its own confirmation link to accept. Whichever way you invite them, one person is one account seat regardless of how many of your teams they are in.

If the address is already in every team you selected, nothing is sent and the app says "No invites sent".

What the invitee sees

An invitation email arrives with a confirmation link. Signed in as the invited address, opening it confirms the membership and shows Welcome to the team!. Signed out, it shows a Create your account form if the address has no account yet, or goes to the sign-in page and back if it has one. A bad or stale token gives Invitation Failed.

An account-only invitation works the same way, and shows Invitation accepted. For either kind, signed in as a different account, the page says the invitation was sent to a different account, and a used or expired link says it is invalid or has expired. Joining a team describes the form.

Someone invited to a team before October 23, 2026 who had no CredenShare account got a different email: the same confirmation link, plus a link to a CredenShare share titled "Your login information" that holds their email address and a generated password. Sending such an invitation created their account with that password. The password is permanent: it keeps working after the share closes, until they change it. The share can be opened for up to 7 days after the invitation and closes five minutes after it is first opened, whichever comes first, so they should be ready to sign in when they click it. The email states its expiry. The share also closes early if you remove them from the team whose invitation carried it (removing a pending invitee is how an invitation is cancelled) or delete that team; neither deletes the account or changes its password. If it closes before they have saved the password, they set a new one with Forgot password? on the sign-in page (Forgotten password). Only the invitation that creates the account carries this share, and owners and admins do not see it in the team's share lists or statistics.

Delivery can take up to a minute. Resend is on a 60-second cooldown per invitee, deliberately, because resending early is what produces two emails instead of one.

Team membership takes effect only when the invite is accepted. A pending member holds no team permissions, gets none of the team's plan features, and occupies no paid seat. The team page's Confirm Invitation step says so: "You are only charged for members who accept the invitation." An admin sees "The team owner is" in place of "You are". For an address with no CredenShare account, nothing is created until they accept: an invitation that is never accepted is deleted 30 days after its link expired, or sooner if you withdraw it. An invitation sent before October 23, 2026 created the account straight away; if it is never accepted and that account is never used, the account is deleted after 30 days, and we email the invited address at least 7 days before.

Members aggregates only the teams you own. An admin who owns no team of their own invites from the team's own page instead, which carries the same Invite Member button. There, the owner sees Send invite when the invitation takes one of the plan's free seats: it sends at once, with no cost step. Otherwise, and always for an admin, Continue opens the Confirm Invitation step. For an admin, that step shows the team owner's seats and says the owner is the one charged.

Roles

Three roles exist: Owner, Admin and Member. There is exactly one owner per team — whoever created it.

A member who attempts an admin action is refused with "You do not have permission to perform this action on this team". Despite the wording, that message means your role is not high enough; it is not a sign that the team is broken.

Changing a role

Role changes happen on the team's own page, and only the owner sees the control. The app states what the change means before applying it:

• Promoting to Admin — "Admins can invite + remove members, edit team settings, and see + manage every team share and secure request. Admins cannot manage billing — that stays with the Owner."
• Demoting to Member — "Members can only see + manage their own shares and requests. They can no longer invite members, edit team settings, or view other members' team data."

The control is hidden on your own row, on the owner's row, and on anyone whose invitation is still pending: a member must accept before their role can be changed.

Despite the word "manage" in the promotion message, a secure request another member created goes no further than its row, for admins and the owner alike. It shows in the team list without View details or Edit, and only the account that created it can open its page, edit it, expire or delete it, or read or export its submissions. Its Delete button is still shown, but the delete is refused with "You do not have permission to perform this action on this team". Here that means you did not create the request, not that your role is too low.

Ownership itself cannot be moved. There is no transfer-ownership flow and no way to appoint a second owner, so a team belongs permanently to the account that created it. If a different person should hold billing and ownership, create the team from their account.

Seats

A seat is a person, not a login session and not a team membership.

Four rules decide the number:

• The owner occupies the first seat. Basic's single included seat is the owner's own, so on Basic the first person you invite is already a paid seat. Plus and Business cover the owner plus four colleagues.
• One person is one seat, however many of your teams they belong to.
• Only confirmed members occupy a paid seat. Pending invitations are listed separately and cost nothing until they are accepted.
• Seats are counted across every team you own, not per team.

When the included seats run out

Nothing is blocked. The next confirmed member simply becomes a billed seat, added automatically at the plan's rate, and the first charge is prorated to the days left in the current billing period. The invite step tells you which case you are in before you commit: either No extra charge, with "Covered by your plan's included seats." beneath it, or Prorated charge with the amount, and "Adds 1 paid seat" at the plan's rate beneath that.

The full picture lives on Profile & Account → Subscription, in the Team Seats card, which reports Included with plan, Currently occupied, Pending invitations, Free seats remaining, Paid seats (billed), Pre-purchased seats and Additional seat price.

Buy seats pre-purchases capacity. Pre-purchased seats act as a floor: they keep being billed after a member leaves, holding the seat for the next person rather than releasing it. Release appears only when you hold pre-purchased seats that current members are not using, and it gives those back.

A seat member has no plan of their own

This is the rule that catches nearly everyone.

Symptom. A colleague on your paid team is told they need to upgrade, sees Free-plan limits, or finds a feature the team pays for locked.

Cause. A seat member has no subscription of their own — they occupy one of yours. Judged personally they resolve to the Free plan, because that is what an account with no subscription is. Their entitlements come from the organisation, and the app resolves the team's plan only when a team context is selected.

Fix. Ask them to use the context switcher in the sidebar — it reads Personal by default and shows the team name once a team is selected — and to pick your team. Feature gating, plan limits and the share allowance then follow the team's plan instead of their own.

The same rule decides which allowance a share consumes. A share created in team context is attributed to the team and draws on the team's pool; a share the same person creates in Personal context is a personal share, judged against their own plan. See Plans and share allowance.

On Business and Enterprise, zero-knowledge custody reaches members the same way: the seat is what entitles a member to enrol and to receive the team key, even though they hold no plan of their own.

Removing a member

On Members, use the row action, tick the teams to remove them from, and confirm. Removing them from every team frees the seat — the app warns that "Removing from every team will free their account seat. They lose access to all shared data."

What removal does not do:

• It does not touch their shares. Shares they created stay live and keep working for recipients until they expire. Removing the person does not delete, expire or reassign them.
• It does not refund the share allowance. Shares already created stay counted for the rest of the period.
• It does not revoke the team key. On a team using zero-knowledge, revoke the member's grant explicitly from the team page's Zero-knowledge for this team section; removing their membership leaves the grant in place.

Removal does revoke any API key the member holds for a team they are removed from, in the same step, and such a key is refused from its next request. API keys that are not bound to that team are not revoked.

Removing a pending entry withdraws that team's invitation, and its link stops working. On Members, Remove on an address with no account withdraws every invitation you sent it, account and teams. For an invitation sent before October 23, 2026, removal also closes the Your login information share from that team's invitation if it is still open. That includes someone whose invitation is still pending. Deleting a team closes every such share it issued. The password inside keeps working. A new invitation to that address carries no login share, because the account already exists, so someone you remove and invite again before they have saved the password signs in with Forgot password?.

Members cannot remove themselves. There is no "leave team" action, so a member who wants out must ask an owner or an admin. Members does not list your own row at all, the team's own page hides the remove action on it, and the owner's row can never be removed.

What no role can read

The access trail of a share belongs to the account that created it, and to nobody else. An owner or an admin can see that a member's share exists in the team's lists, but the trail behind it — timestamps, IP addresses, platform, failed password attempts — is refused to every other account, with the same message an under-privileged member gets: "You do not have permission to perform this action on this team".

The account-level audit export is scoped the same way: it returns your own history only. Owning the team, and paying for the seat, does not open another person's trail. See Key concepts for what the trail records and how long each plan keeps it.