Your team

Open Settings, then People. An owner or admin types the person's email address, picks Viewer or Admin, and sends the invitation. When the service sends email, the person gets one with a link; when it does not, you get a link to pass on yourself, shown once. Either way the link works once, for that address only, for 7 days, and only the newest invitation to an address counts.

The person opens the link, signs in if they already have an account (or makes one, with no workspace or trial of its own), and lands in your workspace as themselves. Someone with an account whose address is not confirmed yet can join only from an emailed invitation, which confirms it; a link you passed on cannot prove who holds the address.

• Pending invitations sit under the people, with Send again, Copy a link instead and Withdraw.
• A workspace can have 50 invitations open at once and send 20 a day (10 on Hosted Free); once three invitations have been emailed to one address in an hour, from any workspace, the next email is refused until the hour has passed; a copied link still works.
• Your own address has to be confirmed before you can invite.

• A viewer sees everything in the workspace and changes nothing. Viewers are free on every plan.
• An admin changes limits, keys and people, and connects computers. Admins need a sign-in code before their first change.
• The owner does everything an admin does, and alone decides the plan, the billing contact and who owns the workspace. There is one owner; only Transfer ownership makes another.

An owner or admin changes a person's role from the People page. Making an admin a viewer, or removing an admin, asks for a sign-in code from the last 15 minutes. Nobody can change the owner's role or remove the owner.

On Hosted Free, when more than 2 people hold the admin role, the owner and the admin who has held the role longest act as admins and the rest act as viewers until a place frees up. Nothing about them is changed: the People page shows who is acting as a viewer and why, the meter says how many places are taken, and the owner can swap a held admin into the last acting place. Moving to Team lets every admin act.

Remove, on a person's row, ends their sign-ins to this workspace at once and emails them. What they did stays in the record under their name, and their account is not deleted: if they belong to another workspace they keep it, and if not, their account stays until they ask us to delete it. Anyone but the owner can leave from the Danger zone in Settings.

The owner hands the workspace to an admin from the Danger zone: their password and a code from the last 15 minutes, and the new owner must have their sign-in code on and their address confirmed. The old owner becomes an admin, both are emailed, and the change is in the record.

Settings, then Activity, lists every change to the workspace, newest first: when, who, what and on what, for the last 90 days on every plan. Everyone in the workspace sees it, viewers included, and nothing in it can be edited or deleted. Filter it by group: people, keys and computers, limits, billing, sign-in, months and files.

The owner is emailed about every change, their own included, batched every ten minutes, so a sign-in that is not theirs shows up fast. The person a change is about is emailed too: invited, removed, role changed, made owner.

On Business the whole record downloads as a CSV from the same page.

One account can belong to several workspaces, with a different role in each. The workspace block at the top of the nav becomes a switcher once you are in two or more: choose one and the app reloads on it. Each sign-in remembers the workspace it was looking at, and a change is always sent for the workspace the page was drawn for, so two tabs on two workspaces cannot write into the wrong one.