Team rules

A team’s rules say what its members need to join it and to keep syncing it. Owners set them, all at once, in one signed entry of the team’s record. Every member can read them.

The Rules page shows them in two groups, by who checks them:

Signing in, Checked by ZestSSH Cloud: what it can see for itself on every request, how you signed in and your account’s address.
On devices, Checked by the app on each device: the app lock, exports and the offline limit, and which devices are approved, which ZestSSH Cloud holds to as well.

A new team has no rules.

Open the rules

On a computer: open the team, choose Team in the rail, then Rules.
On a phone: open More, tap the team under Team, then tap Rules.

Only owners change the rules. Everyone else sees the same page, read only, with the line Only owners change the rules.

The rules at a glance

Group	Rule	What it asks for	Checked by
Signing in	Two-step sign-in	Members sign in with a second factor.	ZestSSH Cloud
Signing in	Company sign-in required	Members sign in through your company sign-in, not with a password, Google or Apple.	ZestSSH Cloud
Signing in	Allowed email domains	Members’ accounts use an address at one of these domains.	ZestSSH Cloud
Signing in	Sign in again	Members sign in again at least this often.	ZestSSH Cloud
On devices	Approved devices only	Members get in only from devices the team approved.	ZestSSH Cloud and every device
On devices	App lock	Members’ devices use the app lock, locking within the longest auto-lock time.	Each device
On devices	No export	Nothing of the team leaves in an export, a share or a QR code, owners included.	Each device
On devices	Offline limit	A device that has not reached ZestSSH Cloud for this long closes the team until it does.	Each device

What each rule does

Met by a sign-in that used two-step sign-in on the member’s ZestSSH account. A member who turns it on has to sign in again with it before the team syncs for them.

Members must sign in through the team’s company sign-in. The switch works only while company sign-in is on. Until then it is locked, and the row says Turn on company sign-in first., with Open Sign-in.

To turn this rule on:

company sign-in must be on,
the team’s Business must be active: in the 14 days after its paid time ends, a rule already on stays on, but it cannot be turned on, and
you must be signed in through company sign-in yourself. Otherwise you see Sign in with SSO first: you must meet this rule yourself.

While the rule is on, nobody can remove company sign-in: turn the rule off first. Turning the rule off is always possible.

People whose address is at a domain the team has not proven, such as guests, cannot meet this rule: company sign-in never answers for their addresses.

Approved devices only

Members get in only from devices someone on the team approved by comparing three words on two screens, and a vault’s certificate authority signs certificates only for those devices. Owners are held to it too. You can turn it on once this device and one more owner device are approved. See Approved devices.

Allowed email domains

Add up to 20 domains, such as northwind.example, with Add. Leave the list empty for any address. ZestSSH Cloud compares each member’s account address with the list.

Your own domain must be on the list. Otherwise saving stops with Add your own domain (northwind.example) as well, or you would stop syncing this team yourself.
While the list is set, nobody can invite an address outside it.

This list needs no DNS proof. It is not the list of proven domains on the Sign-in page, which company sign-in and directory sync use.

Choose Not required, Every hour, Every 4 hours, Every 8 hours or Every 12 hours, or Every day up to Every 365 days (1, 7, 14, 30, 60, 90, 180 or 365 days). ZestSSH Cloud counts from the member’s last real sign-in. A computer that keeps its session going does not count as signing in again.

A setup file can set this rule in days and in hours at once. Then members are held to the shorter of the two.

App lock and the longest auto-lock time

With App lock on, every member’s device must have the app lock on, with a PIN or biometrics. Then choose a Longest auto-lock time: Any, 1, 5, 10, 15 or 30 minutes, or 1, 4, 8 or 24 hours. Each device’s auto-lock must be set to that time or less.

With a time set, members’ apps also lock after that long without a key press or click, even while ZestSSH is in front. On a member’s device, Lock when idle in the security settings says how many minutes a team asks for at most.

The rule is kept per device. A device whose lock is off, or waits longer, stops syncing the team until it is fixed. The member’s other devices carry on.

See PIN lock and Biometric lock.

No export

Nothing of the team goes into an export, a share or a QR code, owners included, and its private keys cannot be exported to a file. Even without this rule, only owners can put a team’s items in an export, a share or a QR code.

Offline limit

Choose No limit, or 1, 3, 7, 14 or 30 days. A device that has not reached ZestSSH Cloud for that long closes the team and shows Closed until online. The team opens again as soon as the device reaches ZestSSH Cloud.

In the last quarter of the limit, and never more than a day ahead, the device warns that the team is about to close and when.
Turning the device’s clock back does not buy time. A clock more than five minutes behind the latest time the device has seen counts as past the limit.
Where the app shows Time during which ZestSSH Cloud itself is down does not count, for up to 7 days in a row. under the limit, a proven outage of ZestSSH Cloud does not count towards it.

For a device with no internet at all, an owner can sign an offline pass.

Vault settings that work like rules

Two more settings are in each vault’s settings on the Vaults page (its pane on a computer, its card on a phone):

Ask again before revealing. Showing or copying a password, passphrase or private key from the vault first asks for the device’s own check (its PIN or passcode, a fingerprint or face, Windows Hello or Touch ID), or for the app’s PIN on a device without one. On a device with neither, the vault’s secrets stay hidden. Anyone who manages the vault can set it.
Offline limit for one vault: No limit, 8 hours, 1 day, 3 days, 7 days or 30 days. It closes only that vault on a device that stays away too long: its hosts do not connect, and its passwords and keys cannot be used or shown. Sessions that are already open stay open. Only owners set it.

Change the rules

Open Rules.
Change the switches, domains and times.
Choose Save rules.
If this device does not meet the new app lock rule, you see This device does not meet them yet. Choose Save anyway to save now and fix this device’s lock afterwards.
If ZestSSH asks you to Confirm it’s you, choose Sign in again. Changing the rules needs a sign-in from the last ten minutes.

You see Rules saved when it worked.

ZestSSH Cloud refuses rules you do not meet yourself, with You do not meet these rules yourself yet and what is missing. Meet them first. For two-step sign-in, turn it on and sign in again with it.

Owners can change the rules even while a rule holds them back, from the banner’s Change the rules. The exception is Approved devices only: from a device nobody approved, an owner can neither read the record nor change the rules.

When a member falls short

Falling short of a rule does not wipe a device, with one exception described below. What is on the device stays and still works, but the team stops syncing for that member until they meet the rule. The team’s subtitle reads Team · Rules not met, and its banner says it “is not syncing: its rules need something from you. What is on this device still works.”

The banner has one line for each rule that is not met, with a way to fix it where there is one:

Rule	What the banner says	Button
Two-step sign-in	Turn on two-step sign-in for your account, then sign in again with it.	Open account, Sign in again
Company sign-in required	Sign in through your company’s SSO to keep syncing it.	Sign in with SSO
Approved devices only	This device is not approved for this team.	Ask to be approved
Allowed email domains	This team is for accounts with an address at northwind.example. Only an owner can change that.	None
Sign in again	Sign in again to keep syncing it.	Sign in again
App lock	Turn on the app lock on this device.	Security settings
Longest auto-lock time	Set this device’s auto-lock to 15 minutes or less.	Security settings

While a member is held back:

they keep using what is on the device;
nothing new reaches them from the team, and nothing they change reaches the team;
their devices keep the app lock, no export and offline limit rules, which ZestSSH Cloud sends with the list of teams even while it holds them back;
every vault asks again before a secret is shown, as if Ask again before revealing were on;
they can still open Rules to see what is asked, and they can leave the team.

One case does remove data: under Approved devices only, a device whose approval was taken back drops what it held of the team. See Remove a device.

Invitations and the rules

An invited person sees which rules they do not meet yet: This team asks for … first. Fix that, then accept. They cannot accept until they meet the rules ZestSSH Cloud checks. Approved devices only is the exception: it applies from their first sync.
The same goes for someone who joins with an invite code: the code’s preview says which rules they do not meet yet, and ZestSSH Cloud refuses the code until they do.
When you confirm someone, ZestSSH Cloud checks two-step sign-in, the allowed email domains and company sign-in against how they signed in when they accepted. If they fell short you see They do not meet this team’s rules yet, and they have to accept again.

Offline pass

Some places have no internet at all. For them an owner can let one device of one member keep the team, or one vault, open for a while, whatever the offline limit says.

On the member’s device, choose Offline pass from an owner. It is on the Rules page while a limit is set, on a vault’s row when the vault has a limit, on the Team page of a team that has closed, and in the notice that warns before a limit closes. It shows a code to scan and a text to send. Nothing secret is in it.
On an owner’s device, choose Sign a request, scan the code or paste the text, and choose Read it.
Check Their device against the code the member reads out, choose how long it Lasts (8 hours, 1 day, 3 days or 7 days), then choose Sign and hand back.
On the member’s device, scan or paste the owner’s answer under What the owner gives you back and choose Use it.

What a pass does not do:

It works only on the device that asked. An owner cannot sign one for the very device they are using.
It lasts at most 7 days, and it cannot be taken back.
It opens nothing the device does not already hold, and gives no access the record does not give.
It never goes through ZestSSH Cloud. The request and the pass travel from screen to camera, or as text by whatever still works.

What needs Business

Of the rules, only Company sign-in required needs Business, as setting up company sign-in does. Directory sync needs it too. Every other rule works without it. On a computer, an owner gets Business from the Seats page: Buy seats opens zestssh.com, where Business is too. For what it costs, see Seats and Business.

If Business lapses, the rule keeps working for 14 days after the paid time ends. After that, directory sync stops, and ZestSSH Cloud no longer holds members to Company sign-in required, so nobody is locked out. Turning the rule on, and setting up or changing company sign-in, need Business to be active.

Limits

App rules, not encryption. The rules each device checks are kept by the app. A device that already holds a team’s keys can, with enough effort outside the app, read what it holds. When someone leaves, remove them from the team too.
All at once. The rules are one entry, signed by the owner who saved them. Every member’s device checks it.
Ranges. At most 20 domains. The app offers the times listed above; the record itself takes at most 365 days, or 8,760 hours, for Sign in again, 24 hours for the auto-lock time and one year for the offline limit.
Not covered here. The Rules page also holds Team recovery, What this team records and Event export. They are separate settings, each turned on or off on its own.

Next steps

Company sign-in (SSO): prove domains and connect your identity provider.
Approved devices: let members in only from devices the team approved.
Directory sync (SCIM): let your company’s directory take access away.
Access on request: give a vault for a set time.
Teams overview: teams, vaults and roles.