Suspend, remove and leave

There are four ways out of a team: suspending someone, an end date, removing someone, and leaving. Each takes access away on ZestSSH Cloud, at once or, for an end date, on its day, and marks the keys the person held for replacement. They differ in what happens on the person’s devices and in how they come back.

Which one to use

	Suspend	Access end date	Remove	Leave
Who can	Owners, admins, and roles with Suspend and remove people below them, for people below them	Owners, admins, and roles with Change the roles and end dates of people below them, for people below them	Same as Suspend	You, unless you are the last owner, while your access counts
Their devices	Keep what they have; nothing syncs	After the date, keep what they have; nothing syncs	Delete the team at their next sync	This device deletes it at once, your other devices at their next sync
Coming back	Resume	A later end date	A new invitation	A new invitation
Seat	Still held	Freed once the date has passed	Freed	Freed
Keys they held	Replaced	Replaced	Replaced	Replaced

Suspending and ending access do not wipe anything: “What they already have stays on their devices”. To make someone’s devices delete the team, remove them.

Nobody can suspend, remove or end the access of an owner. Owners are equals; an owner steps down or leaves. Only owners can set an admin’s end date, and owners have none. A guest’s end date is also the owners’ alone: see Guests.

Suspend someone

Open the Team pages, then Members, and open the person. On a computer, click their row; elsewhere, use the row’s menu.
Choose Suspend. The dialog Suspend robin@example.com? says “Nothing syncs to or from their devices until you resume them. What they already have stays on their devices, so the keys they held are replaced: nothing written from here on opens with them.”
Choose Suspend. If Confirm it’s you appears, choose Sign in again; it first says what the change will do.

ZestSSH says “robin@example.com is suspended”, replaces the keys your role may replace, and shows what they could use.

On their devices the team shows Team · Suspended and the banner “Your access to Example Ops is suspended. What’s on this device stays, but nothing syncs until an owner or admin resumes you.” ZestSSH Cloud tells them only that they are suspended. A suspended member still holds a seat.

Resume someone

In Members, open the person and choose Resume.
Read “They get back what their role gives, with the keys to open it, including any replaced while they were suspended.”, then choose Resume.

ZestSSH says “robin@example.com is back”. Your device seals every key they get back to them, so it must hold those keys and trust their keys. If it does not, ZestSSH says “A key this change hands on isn’t on this device. Sync, then try again.” or asks you to compare their fingerprint first.

Remove someone

In Members, open the person and choose Remove from the team.
The dialog Remove robin@example.com? says “Their devices take this team off at their next sync, and the keys they held are replaced so nothing written from now on opens with them. Anything they already copied elsewhere can’t be taken back.”
Choose Remove, and sign in again if asked.

ZestSSH says “robin@example.com was removed”, replaces the keys your role may replace, and shows what they could use. To come back, they need a new invitation.

Set an access end date

In Members, open the person and choose Access end date. On a computer, it is Change next to Access ends in their panel.
Choose a day: “Their access lasts through the day you pick. After that, nothing opens for them and their devices stop syncing this team.” Choose No end date to take an end date away.
Choose Save, and sign in again if asked.

The member list shows Until and the date, then Access ended. In the last 14 days, the Overview lists “robin@example.com’s access ends on” the date under Needs attention, with Change date.

When the date passes, ZestSSH Cloud stops serving them, and within minutes drops the copies of keys it held for them and marks those keys for replacement. Their devices say “Your access to Example Ops has ended. What’s on this device stays, but nothing syncs.” Giving them a later end date brings everything back, with every key they need.

Leave a team

Open Members and open your own row.
Choose Leave the team.
Read “Its hosts, keys and everything else in it leave this device, and your other devices at their next sync. To come back, someone has to invite you again.”, then choose Leave.

ZestSSH switches back to your personal space and says “You left Example Ops”. Leaving needs no recent sign-in.

The last owner cannot leave. Make another owner first.
You can leave only while your access counts. While you are suspended, or once your end date has passed, ZestSSH does not offer Leave the team, nor Step down to admin: ask an owner or admin to remove you.
The keys you held are not replaced by you. The owners, admins and those who manage your vaults see a banner asking them to replace them.

A team with one owner depends on that one account. The Overview and Members say so: “You’re the only owner. If you lose access to your account, nobody can run this team, and vaults only owners can open stay locked. Make someone you trust an owner too.”

To make someone an owner:

In Members, open the person and choose Make owner. If you have not compared codes with them, ZestSSH asks you to first: Compare codes.
Read Make robin@example.com an owner?: “Owners can do everything in this team. Owners are equals: once robin@example.com is an owner, no one else can change their access. Only they can step down.”
To hand the team over, tick Step down to admin myself (hand the team over).
Choose Make owner, and sign in again if asked.

To step down without making a new owner, open your own row and choose Step down to admin. This needs another owner: “You keep every vault that isn’t owners-only and can still manage everyone below Admin. Only an owner can make you an owner again.”

A sole owner cannot delete their ZestSSH account while other people are in that team: ZestSSH Cloud asks them to hand over ownership, or remove the others, first. A team they are alone in goes with the account.

What they could use

Right after you suspend or remove someone, if there is anything they could use, ZestSSH shows What robin@example.com could use: “A password or key someone could see stays seen. Change these on the servers they open, starting with the keys they could see.” It lists:

the keys they could see or copy, with the hosts each one opens;
the keys they could connect with but were never shown;
the vaults you cannot open yourself, with “Ask … what it holds” naming who manages each.

Copy the list copies it as plain text. The same list stays on this device’s Overview under Change these next, until you choose Mark changed for each key.

Owners and admins can open What they could use on any member at any time. The list is built from what your device holds and reads no secret. Keys held by a hardware token or an agent are left out, since nothing of theirs is in the team.

Replace the keys they held

When someone loses the team or a vault, by any of the four ways above or because their role or extra vaults changed, ZestSSH Cloud drops the copies of those keys it held for them and marks the keys for replacement. Replacing a key makes its next generation, sealed to exactly the people who still hold it.

The team’s key is replaced by owners and admins. A vault’s key is replaced by whoever manages it.
The device that made the change replaces, right away, the keys its account may replace.
Anything left shows a banner to the people who may replace it: “Someone lost access to Example Ops. Replace the keys they held, so nothing written from now on opens with them.” Choose Replace keys. ZestSSH says Keys replaced, or “Some keys still need replacing. Use Replace keys on the team’s banner to try again.”
On a computer, the rail’s Team item shows a dot while keys wait; on a phone, the team’s row in More does.

Replacing keys needs no recent sign-in.

What replacing keys does not do:

It does not re-encrypt what is there. Items written from then on use the new key. Items already in a vault keep the key they were written with. The person who lost access can no longer fetch anything from ZestSSH Cloud, but their devices may still hold what they had.
It does not change your servers. Change the passwords and keys from What they could use on the servers themselves.
It cannot reach someone whose keys show Keys changed. A key is never sealed to keys your device does not trust: ZestSSH says “The keys of robin@example.com changed and haven’t been checked on this device. Compare their fingerprint first.”

What each device does

The person removed: their devices delete the team and its database key the next time they sync, which happens when ZestSSH is open and unlocked and reaches ZestSSH Cloud. A device that is never opened again keeps its encrypted copy. An owner can set the Offline limit rule so that “A device that has not reached ZestSSH Cloud for this long closes the team until it does.”
The person suspended, or whose access ended: what is on their devices stays, and nothing syncs.
Everyone else: nothing to do by hand. Devices sync when ZestSSH is unlocked, every 15 minutes, and when ZestSSH Cloud tells them something changed. They fetch the new keys then. A device that tries to write with an old vault key is refused and fetches the new key before its changes go through.

If a device was lost, not a person

If one of your own devices is lost or stolen, sign it out (see Signed-in devices), then open the Account page and, under Your keys, choose Replace keys. “New keys replace your current ones, every team and vault key you hold is sealed to them, and the teams and vaults you manage get new keys too, so the old keys open nothing written from now on.” Teammates who had compared you then see Keys replaced since you compared, and should compare with you again.

If every device that had your keys is gone, see Team recovery.

Limits

What was seen stays seen. Nothing in ZestSSH takes back a password or key someone could see or copy. Change it on the server.
Suspending and end dates do not wipe devices. Remove the person to make their devices delete the team.
Owners cannot be removed. Owners step down or leave.
The device rules are the app’s. “The rules each device checks are kept by the app, not by encryption. When someone leaves, remove them from the team too.”
Change these next lives on one device: the one that took the person’s access.

Next steps

Guests: access that always ends on a date.
Vaults, access and roles: lower someone’s access instead of removing them.
Create a team and invite people: invite someone back.
Team recovery: when a member loses every device.