Teams overview

ZestSSH keeps your own hosts and keys in your personal space. A team shares hosts and keys among its members, and inside a team they sit in shared vaults. Everything in a vault is encrypted on members’ devices before it leaves them.

This page explains the parts and who may do what. To set one up, see Create a team and invite people. To join one with a code someone gave you, see Join a team with a code.

Your personal space, teams and vaults

Your personal space holds the hosts, keys, snippets and other items you keep for yourself. The switcher calls it Personal: “Your own hosts, keys and snippets.” Your personal sync and your backups read your personal space and nothing else.
A team is a shared space next to your personal space. It has members, roles and rules. Each device keeps every team it is in as a database of its own, apart from your personal space. Teams are always kept on ZestSSH Cloud, whatever storage your personal sync uses.
A vault holds a team’s shared hosts, keys, snippets and port forwards. Each vault has its own key and its own list of who may open it, and you only see the vaults you can open. Shared vaults exist only inside teams: your personal space has none.

Nothing moves from your personal space into a team unless you move it.

Switching between them

Picking a space switches the whole app: every screen then shows that space’s hosts, keys and snippets.

On a computer: open the switcher in the bar at the top of the window (top left on Windows and Linux, top right on macOS). It lists Personal, then under Teams each team with a line such as Team · Owner, then Create a team, Invitations, Join a team and Sync teams now.
On a phone: tap the name at the top of the Hosts tab. The sheet lists the same spaces and actions.

The team itself is run from its Team pages:

On a computer: while a team is open, the rail starts with a Team group with Team and Vaults.
On a phone: open More, then the team under Team.

The Team pages start with Overview, then come in three groups, with Setup file at the foot:

People: Members, Roles and Seats.
Access: Vaults, Rules and Sign-in.
Records: Activity and Trust.

Not everyone sees all of them: Roles, Sign-in and Activity are for owners, and Setup file for owners and admins. Seats and Vaults show while the team syncs for you, and Rules also while a rule holds you back.

The Overview shows the team at a glance: how many members, vaults and hosts it has, its rules, what Needs attention (for example people who wait to join, members nobody has verified, or a sole owner), Recent changes with See all in Trust, and Access for a set time.

Roles

Every team has two fixed roles at the top, Owner and Admin. Below them come the roles the owners make. A new team starts with one of those, named Member, which gives Use in the first vault and no other powers. Owners can rename it, change it, and make more, up to 30 roles.

Roles are ranked: owners first, then admins, then the owners’ roles from highest to lowest. You can manage only people below you. Owners are equals: nobody can suspend, remove or change another owner, and an owner leaves the role only by stepping down or leaving.

A guest is not a role. It is someone whose address is outside the team’s proven domains, invited into a role like anyone else. See Guests.

What each role may do

	Owner	Admin	Roles the owners make
Open vaults	Every vault, owners-only ones included	Every vault except owners-only ones	The vaults the role gives, plus any extra vaults given to them
Invite people and add them	Into Admin or any role the owners made	Into any role the owners made	With Invite people into roles below theirs: into roles below their own
Invite guests	Yes, always with an end date	No	No
Change roles and end dates	Of everyone below Owner	Of people below Admin	With Change the roles and end dates of people below them
Suspend and remove people	Everyone below Owner	People below Admin	With Suspend and remove people below them
Make someone an owner or admin	Yes, after comparing codes with them	No	No
Add vaults	Yes, owners-only ones too	Yes	With Add vaults (they manage the ones they add)
Rename a vault and set what it allows	Every vault	Every vault except owners-only ones	Vaults where they have Manage
Rename the team	Yes	Yes	No
Make roles, set the rules, prove domains, buy seats, choose what the team records	Yes	No	No
Export the team’s items	Yes, unless the No export rule is on	No	No
Leave the team	Yes, while another owner stays	Yes	Yes

What a role gives in each vault is an access level: Connect, Use, Edit or Manage. See Vaults, access and roles.

What is end-to-end encrypted

Everything in a vault. Each item is encrypted on the device with AES-256-GCM under its vault’s key, and signed with its author’s account key, so nobody without that key, ZestSSH Cloud included, can forge or change an edit.
Names. The team’s name, its vaults’ names and its roles’ names are encrypted with the team’s or the vault’s key.
The team’s and vaults’ keys. They are made on a member’s device. ZestSSH Cloud holds them only sealed to each member’s account key, one copy per member. A device opens a copy only when an account it trusts in that team signed it, and only when the key inside matches the commitment in the team’s record, so a key nobody in the team made is refused.
Item ids. An item’s id on the server is derived under a key only the vault’s members hold, so the ids tell the server nothing.

What ZestSSH Cloud can see

ZestSSH Cloud hosts the team, so some things are not encrypted:

who is in each team (their accounts and email addresses), their roles, which vaults each person may open and at which level, end dates, and who is suspended;
the team’s record of changes, the rules (for example required two-step sign-in or allowed address domains) and each vault’s settings;
invitations: the address, the role, the vaults offered, the end date and who invited. For an invite code there is no address: ZestSSH Cloud keeps a lookup id derived from the code, never the code, and what the person is shown sealed under the code (see What the code proves);
each item as an encrypted record with an opaque id, a revision number and whether it was deleted. It keeps no author and no edit time for items.

What a team records about how its members use it (version history, activity, devices, sign-in addresses) is off until an owner turns it on. Everyone in the team sees what is on and is told when it changes, and an invitation says what the team records before the person accepts.

What ZestSSH Cloud cannot do

Every change to who is in a team and what they may do is an entry in the team’s record, signed by the member who made it and chained to the entry before. Every member’s app checks each entry against the same rules the server applies. So the server cannot add a member, promote anyone, or pass off a change by someone whose role does not allow it. The Trust page lists the entries as your device checked them.

The record cannot stop one thing by itself: the keys of someone who joins reach you through ZestSSH Cloud, and a server that knows every public key could show you a key of its own. What stops a swapped key is people comparing fingerprints, on a call or in person, or an invite code, which checks both sides’ keys. That is why adding someone always starts with one of the two. See Why you compare fingerprints and What the code proves.

What a team needs

A ZestSSH account, signed in. Signed out, ZestSSH says “Sign in to use teams.”
Your team keys. Everything a team hands you is sealed to your team keys. Your team keys are made on the device the first time you make or join a team, sync on or not. Sync carries them, encrypted, to your other devices. A team with a seat bought includes ZestSSH Cloud sync (and Squeezed) for everyone in it, so you do not need Juiced or storage of your own for it. See Your team keys. Their private halves move between your devices only inside your encrypted personal sync and backups.
Seats. Everyone in the team holds a seat, you included: its members, suspended ones too, and people invited who have not joined yet. No team is free. A new team has no seats until an owner buys some or redeems a seat code, except that a team with an owner who holds the personal Bundle gets one seat included. While a team has more people than seats, nothing is lost and existing items keep working, but new items wait on the device and new invitations are refused until an owner buys seats.
Business, only for some company features. Setting up or changing company sign-in (SSO), directory sync (SCIM), the Company sign-in required rule, and more than 25 seats need it. Nothing else in a team does.

Creating or joining a team does not need Squeezed or Juiced: what is counted is seats.

Seats and Business

Team seats are $100 each, paid once. A team’s first purchase brings it to at least two seats (an owner’s Bundle seat counts), and a team holds up to 25 seats.
Business is $15 a seat a month, or $150 a seat a year, on top of the seats. With it, a team can hold more than 25 seats, up to 1,000.
Where to buy. Owners buy seats on a computer: Buy seats on the Seats page opens zestssh.com in your browser, where Business and invoices are too. Redeem a code next to it takes a seat code. Phones and tablets show the seats but sell nothing.
If Business lapses, directory sync and the Company sign-in required rule keep working for 14 days after the paid time ends, but company sign-in can no longer be changed. After that, directory sync stops and the rule is no longer applied, so nobody is locked out. Signing in through company sign-in goes on either way.

For the full price list, see zestssh.com/pricing.

What members get

While you are a member of a team that has bought at least one seat, and your access is not suspended, held back by your company’s directory or past its end date:

Squeezed and Juiced for your personal space. ZestSSH Cloud gives you both for as long as you are in the team. A seat that comes only with an owner’s Bundle does not count.
No device limit on ZestSSH Cloud. On Juiced alone, ZestSSH Cloud syncs up to seven devices for one person. A member of a paid team has no such limit.

After you leave a paid team, ZestSSH Cloud still lets you download your personal copy for 30 days, but no longer takes changes to it unless you have Juiced of your own.

Limits

App rules are not encryption. What Connect hides, the owners-only export and the device rules (app lock, no export, offline limit) are kept by the ZestSSH app. A device that can connect with a key holds that key.
What someone saw stays seen. Taking access away cannot take back a password or key a person could see or copy.
Nothing is shared before someone is added. An invitation alone gives no keys and shows no names. An invite code shows the team’s name and the offer to whoever holds the code, and nothing more.
ZestSSH Cloud only. Teams are not kept on WebDAV, S3, Google Drive or a custom sync server, even when your personal sync uses one.
Your backups hold your personal space. Personal sync and backups never contain a team’s items.
Sizes. An account owns at most 20 teams, and a team holds at most 200 vaults and 30 roles of its own.
A sole owner is a risk. “If you lose access to your account, nobody can run this team, and vaults only owners can open stay locked.” Make a second owner.

Next steps

Create a team and invite people: set up a team and add people safely.
Join a team with a code: invite, or join, with a one-time code or QR code.
Vaults, access and roles: decide who opens what.
Suspend, remove and leave: take access away and replace the keys.
Guests: people from outside your company’s domains.
Team recovery: when a member loses every device.
Cloud sync: the personal sync that carries your account keys.
Seats and billing: buying seats and Business.
Pricing: what seats and Business cost.