Team recovery

Your account keys are what open a team’s vaults for you. If every device that held them is gone, nothing in your teams opens for you any more. Team recovery lets two owners of the team give your access back under new keys that you make on a new device, instead of removing you and inviting you again. Neither owner can do it alone, and your personal space is never part of it.

Team recovery is off until the team’s owners turn it on.

Do you need it?

Only when your account keys are really gone.

You can still unlock your sync. Your account keys travel inside your encrypted personal sync, so every device you sign in on and unlock gets the same keys. Sign in on the new device, unlock sync, and your keys come back. You do not need team recovery.
You still have a device with your keys. Nothing is lost. On that device, sign the lost device out (see Signed-in devices), then use Replace keys on the account page (see Suspend, remove and leave). A device that holds your keys never offers Start over; it says This device has your keys: use Replace keys instead.
Every device is gone and you cannot unlock your sync. This is what team recovery is for.

Turn team recovery on

You need two owners. The team’s record refuses to turn team recovery on with fewer, because two different owners approve each recovery.

Open Team, then Rules.
Find the Team recovery section. With only one owner it says Team recovery needs a second owner., and Add a second owner takes you to Members.
Choose Turn on, then confirm Turn on team recovery? with Turn on.
If your last sign-in was more than 10 minutes ago, Confirm it’s you appears. Choose Sign in again and sign in, with your second step if you use one.

The section then shows On, and the other members are told with a notification such as “Team recovery is on in Example Ops”.

Only owners turn it on or off. Everyone else sees Only owners turn team recovery on or off.

To turn it off, choose Turn off in the same section and confirm Turn off team recovery?. Turning it off does not need a second owner. From then on, someone who loses every device needs a new invitation, and the other members are told.

You can turn team recovery on after someone has already lost their devices. Owners see that person waiting as soon as it is on.

Who holds what

Who	What they hold or do
The member	New account keys, made on their new device when they start over. The words teammates compare come from these keys.
The first owner	Compares the member’s new words with them, then signs an approval of exactly those keys. ZestSSH Cloud keeps the signed approval until the recovery is done.
The second owner	Compares the words too, then completes the recovery: a record entry that carries the first owner’s approval, and a copy of every team and vault key the member should hold, sealed to the new keys, all in one step.
ZestSSH Cloud	Stores the approval and the sealed copies, and checks the signatures. It cannot open the copies, and it cannot recover anyone on its own: the entry must be signed by an owner and carry a second owner’s signed approval, and every member’s app checks both.

Get back in after losing every device

Install ZestSSH on a new device and sign in to your account.
Open your account page: on a phone, More, then Account; on a computer, Settings, then Account and security. Under Your keys you see Your keys are on another device.
Choose Start over. Read Start over with new keys?, then choose Start over with new keys.
If ZestSSH asks you to Sign in again, do so. Starting over changes what your teammates trust, so it needs a recent sign-in.
ZestSSH says You have new keys. Ask two owners in each team to give your access back.
Open the team. A banner says that nothing in it opens until two owners give your access back. Choose Show my words.
In Waiting for two owners, read your words to two owners, on a call or in person. Show my code shows them as a code an owner can scan. The line under the words, such as Approvals: 0 of 2, counts how far the owners are.
When the second owner is done, you get a notification such as “Your access to Example Ops is back”, and the team syncs for you again.

Starting over changes these things:

Your new keys replace the old ones for everyone, and your teammates see that your keys changed.
ZestSSH Cloud drops every key copy sealed to your old keys, and every recovery approval that named you.
Nothing in your teams syncs until two owners give your access back, or an owner invites you again.
Your personal space is not affected.

If team recovery is off in a team, Waiting for two owners says so and suggests that you ask an owner to turn it on, or to invite you again.

Approve or complete a recovery (owners)

A member who started over shows up on the team’s Overview, for example “priya@example.com lost every device and waits for two owners”, and under Waiting for recovery in the Team recovery section of Rules. Each row says Nobody approved yet, Approved by you, or which owner approved.

The first owner:

Choose Review next to the member.
Call the member, or meet them, and compare the words in the dialog with the words they read to you. Their new words must match exactly. On a phone you can choose Scan their code instead, and point the camera at the code on their screen.
Choose The words match: approve. Sign in again if asked.

The second owner:

Choose Review. The dialog names the owner who already compared these words and approved.
Compare the words with the member yourself. The first owner’s approval does not replace your own check.
Choose The words match: give access back. Sign in again if asked.

After the second owner completes it:

The member gets back every key they held, as far as the team’s record lets them open vaults now.
The second owner’s device marks the member’s new keys as checked, and tells the other members’ devices that it checked them.
Everyone else in the team is told, for example “priya@example.com’s access to Example Ops is back” and “alex@example.com and sam@example.com compared their new keys and gave the access back.”

If the words don’t match, stop. As the dialog warns, someone else may have started over in the member’s name.

To take your approval back before the recovery is done, choose Review again, then Take back my approval.

What an approval covers

An approval covers one set of keys: the member’s new keys, in this team, signed with your current keys. It is a statement of its own kind and never an ordinary fingerprint check, so a check you made for another reason can never count as an approval. If the member starts over again, the earlier approvals no longer count, and both owners compare the new words.

Rules and limits

Two different owners, neither of them the member. Recovering an owner takes two other owners.
Only for someone still in the team. A member who was removed cannot be recovered. Invite them again instead.
Nothing beyond what the record gives. The member gets back the keys of the vaults the team’s record lets them open now, and nothing else.
Approved devices start again. Where the team lets in Approved devices only (see Approved devices), the recovered member’s devices need approving again: the devices approved before held the keys that are gone.
Each team on its own. You wait in each of your teams, and two owners of each one give your access back there.
Recent sign-in. Starting over, turning team recovery on or off, approving and completing each need a sign-in from the last 10 minutes. Taking back an approval does not.
Personal spaces are never part of it. Team recovery gives back team access only.
It does not turn itself off. If the team drops to one owner, team recovery stays on, and its section says Team recovery is on, but with one owner it cannot finish: a second owner has to approve it. No recovery can be completed until there are two owners again.
A certificate authority may need a new key. When someone who could open the vault that keeps a certificate authority’s key is recovered, that authority asks for a new key, since the lost devices may still hold the old one. See Certificate authority.

Next steps

Teams overview: how your personal space, a team and its vaults fit together.
Create a team and invite people: the other way back in, a new invitation.
Suspend, remove and leave: replacing your keys after you lose one device.
Certificate authority: short-lived certificates for a vault’s hosts.
Cloud sync: the personal sync that carries your account keys to your other devices.
Seats and billing: what a team costs, and what Business adds.