Team and roles
Invite people to a site or a whole workspace, what owner, admin and viewer can each do, and how billing transfers work.
Roles
| Role | What it can do |
|---|---|
| Owner | Everything, including deleting the site, managing every member, and the transfer flows. Every site has exactly one owner. |
| Admin | Manage settings, keys, sharing, funnels and members, everything except deleting the site or removing its owner. |
| Viewer | Read everything, change nothing: dashboards, funnels and settings are visible read-only, and the first toggle they cannot flip says so up front. |
Invitations
- Invite by email from the site's Team tab; the invitation shows its status and expiry beside each pending entry.
- Resending mints a fresh link and the previous one stops working.
- Membership is per site: someone can be an admin on one site and a viewer on another.
Workspaces
A workspace is a team that reaches a group of sites at once, so an agency or a company does not invite each teammate to each site. Manage it under Account → Workspace.
- A workspace member reaches every site in the workspace with their workspace role, including sites added later.
- Someone who is both a workspace member and a member of the site itself gets the higher of the two roles.
- A site's own members are unaffected: a client invited to one site still sees only that site.
- Only a site's direct owner can move it into or out of a workspace, and moving it in also takes owner or admin in the workspace.
- Leaving a workspace, or a site leaving it, ends that access at once: open realtime views close, and the read keys and payment connections the person held on those sites are revoked, as when a site member is removed.
- A workspace role never makes someone a site's billing owner, and only a workspace owner can grant, revoke or invite the owner role.
Who pays, and handing that over
One member is the billing owner: the site counts against their plan. Two flows exist for changing that, both under Settings:
- Billing transfer: the billing owner nominates a member, who accepts or declines. If the acceptor's plan has no room, the transfer completes and the site pauses until they upgrade; the copy in the flow says so before anyone commits.
- Leaving or being removed: an owner leaving names a successor first, so a site is never left ownerless.
Security
Destructive steps (deleting a site, deleting an account, removing a member's access to money) ask for a recent re-authentication, not just a live cookie. Every credential event on an account (a key created, an app connected, a first use from a new source) is journalled and visible to the account owner.