Guests

A guest is someone whose email address is outside the domains your team has proven: a contractor, an auditor, someone at a partner company. A guest is not a role. You invite them into a role like anyone else; what makes them a guest is their address, and it brings two rules:

Only owners invite a guest, or move a guest’s end date.
A guest’s access always has an end date.

Until the team has proven at least one domain, nobody is a guest.

Who counts as a guest

The part of the address after the @ is compared with the proven domains, exactly. With example.com proven:

robin@example.com is a member like any other.
morgan@partner.example.com is a guest. An address at a subdomain counts as outside unless that subdomain is proven too.

A domain that is claimed but not proven yet does not count.

Prove your company’s domains

Proving a domain is an owner’s job. It is also what company sign-in (SSO) and directory sync rest on.

Open the Team pages, then Sign-in. Step 1 is Prove your domains: “Prove the domains your company’s addresses use. Company sign-in (SSO) and directory sync work only for proven domains.”
Type the domain, for example example.com, and choose Add.
ZestSSH says “Add this TXT record where you manage DNS for example.com:” and shows the record’s Type, Name and Value. The value starts with zestssh-verify=. Copy it with the button next to it (Copy the record), and add the record as a TXT record of the domain at your DNS provider.
Choose Check now. Once ZestSSH Cloud finds the record, it says “example.com is proven”, and the domain shows Proven on and the date. Until then it shows Waiting for its DNS record, and a check says “The record isn’t there yet. DNS changes can take a while to spread, so try again in a few minutes.”

Keep the TXT record in place:

ZestSSH Cloud checks every proven domain again each day. After three failed checks in a row the domain is no longer proven, and the owners are told.
One team per domain. “Another team has already proven this domain.”
Up to 20 domains per team.
Removing a proven domain (the cross next to it, Remove domain) needs a sign-in from the last 10 minutes: “Company sign-in stops working for addresses at this domain until it is proven again.”

Proving domains does not need Business.

Invite a guest

Choose Invite people (or Invite someone) as for any invitation. See Invite someone.
Type the address, for example morgan@partner.example.com. As soon as it is outside the proven domains, the dialog says “Outside your company’s domains, so a guest: their access needs an end date.”
Next to Access ends, choose Pick a date. Pick the last day of their access and choose Save.
Pick the role and any vaults, then choose Send invitation.

Send invitation stays off until an end date is set. For anyone but an owner the dialog says “Only owners can invite or change people outside your company’s domains.”, and Send invitation stays off. ZestSSH Cloud refuses such an invitation in any case.

The guest then accepts, and you compare fingerprints and add them, as with anyone. See Compare fingerprints and add them.

Invite a guest with a code

A guest can also join with an invite code, as long as an owner made the code and it has an end date under Access ends. Otherwise ZestSSH Cloud refuses the code when they use it, and they see “This team takes people from outside its own domains only with a code an owner made. Ask an owner for one.” or “This team takes people from outside its own domains only for a set time. Ask for a code with an end date.”

Before accepting, the guest’s invitation shows when their access would end: “Your access would end on” and the date.

End dates

Through the day you pick. Access lasts to the end of that day on the clock of the device that set it. You can pick any day from today to five years ahead.
Only owners move a guest’s end date. Anyone else who may change end dates gets “Only owners can invite or change people outside your company’s domains.”
It cannot be taken away. Choosing No end date for a guest is refused: “Someone outside your company’s domains needs an end date.”
You are reminded. In the last 14 days, the Overview lists “morgan@partner.example.com’s access ends on” the date under Needs attention, with Change date.

When a guest’s access ends

ZestSSH Cloud stops serving them at the end of the day, and within minutes drops the copies of keys it held for them and marks those keys for replacement. Replace them with Replace keys on the team’s banner; see Replace the keys they held.
Their devices keep what they have. They say “Your access to Example Ops has ended. What’s on this device stays, but nothing syncs.” To make their devices delete the team, remove them: see Remove someone.
Their seat is freed.
An owner can bring them back with a later end date.

Rules that affect guests

Allowed email domains. If the team’s rules list allowed email domains, an address outside them cannot be invited at all. Guests are possible only from domains that rule allows, or when it is empty.
Company sign-in required. Company sign-in answers only for proven domains, so a guest cannot sign in through it. With this rule on, a guest cannot accept an invitation, and a guest already in is held back from syncing.
Everything else (two-step sign-in, the app lock, the offline limit) applies to guests as to everyone.

Limits

The address decides. Guest status follows the address of the account they sign in with, compared exactly.
Checked on invitation and on end date changes. Someone already in the team when a domain stops being proven is not given an end date by that; the guest rules apply the next time their end date changes.
The dialog’s note is a preview. It comes from the proven domains your device could read; ZestSSH Cloud applies the guest rules either way.
An end date is not a wipe. Like any end date, it stops syncing but leaves what is on their devices. Remove guests you are done with.

Next steps

Create a team and invite people: the full invitation flow.
Join a team with a code: invite with a one-time code.
Suspend, remove and leave: end dates, removal and key replacement.
Vaults, access and roles: give a guest only the vaults they need.