Roles & Access

Give everyone exactly the access they need

Every workspace has three roles - owner, admin and guest. Guests are the flexible one: you decide, project by project, whether they can view, edit or manage, so contractors and even clients can work alongside your team without seeing more than they should.

Why it matters

What roles do for you

Least privilege by default

A guest starts with access to nothing. You grant one project at a time - or every project at once - and pick Viewer, Editor or Project admin for each.

Safe to bring in outsiders

Add a contractor or a client as a guest. They work on their projects without ever seeing invoices, finance, other clients or the activity log.

Billing and structure stay protected

Only the owner and admins can create or delete projects, send invoices, change the plan or invite people, so one wrong click from a guest can't undo months of setup.

Vault items stay private

Guests only see credentials they created, ones shared with them, or ones inside a project they belong to. Nothing is visible workspace-wide just because someone joined.

A role belongs to a membership, not a person

Invite the same colleague to two workspaces and they can be an admin in one and a guest in the other. Every plan includes a set number of members, so there is no per-seat cost to giving someone the right role.

Workspace roles

Three roles, one per person per workspace

When you invite someone you pick admin or guest. The owner is set once, when the workspace is created, and can be handed to another member later.

Owner

Full control, including ownership and deleting the workspace.

Best for: The person who created the workspace - usually the agency principal or founder.

There is exactly one owner per workspace. The owner can do everything an admin can, plus transfer ownership to another active member and delete the workspace - both ask for the owner's password again. The owner can't be removed, demoted or disabled by anyone.

Admin

Runs the workspace day to day - everything except ownership and deletion.

Best for: Operations leads and senior team - people you trust to run the business side and manage who is in the workspace.

Admins manage clients, projects, invoices, expenses, renewals, reports, billing and the member list. They see every project and every vault item, and manage environments, tags, folders and .env variables. They can't transfer or delete the workspace, or change the owner.

Guest

Sees only the projects and vault items they're given.

Best for: Contractors, collaborators and clients who need to work on specific projects, not the whole business.

Guests have no access to finance, clients, reports or the activity log. They see the projects an admin adds them to, plus the vault items that are theirs or shared with them. What they can do on each project depends on their project role.

Who can do what

Workspace access at a glance

Every capability in the product, and which workspace roles have it.

Capability	Owner	Admin	Guest
Workspace & people
Rename the workspace and change its logo
Invite members, change their role, disable or remove them
Choose or change the plan and manage billing
Transfer ownership to another member
Delete the whole workspace
Clients & projects
Open the dashboard and the clients area
Add, edit and delete clients, and share their portal link
Create and delete projects
See projects			Granted projects
Give someone access to a project (guests: only as project admin)			Granted projects
Give a guest access to every project at once
Finance & insight
Invoices, expenses and renewals
Revenue, expense and renewal reports
Activity log and its CSV export
Vault
See credentials			Shared & project items
Reveal a secret or a 2FA code			Shared & project items
Add and edit credentials			Granted projects
Delete credentials
Share a credential with a teammate			Own items
Create an expiring share link for a credential			Shared & project items
Password health report			Shared & project items
Environments, tags & .env
Create, rename and delete environments and tags
Create and delete env folders, and share them
Add, edit, delete and import env variables
See env folders and their variables			Shared & project items

Shared & project items - only credentials the guest created, that were shared with them, or that sit in a project they belong to. Granted projects - only on projects they’ve been added to, and what they can do there depends on their project role below. Own items - only things they created themselves.

Project roles

For guests: access, one project at a time

Adding a guest to a project gives them one of three project roles. Owners and admins are never limited by these - they can do all of it on every project.

Viewer

Read and reveal. Nothing else.

Best for: Someone who needs a project's credentials and context but shouldn't change anything.

Sees the project, who else has access, and every credential in it, and can reveal secrets and 2FA codes. Can't edit the project or its credentials.

Editor

Edit the project and its credentials.

Best for: A contractor or teammate doing hands-on work on the project.

Everything a viewer can do, plus editing the project's details and adding or updating credentials inside it. Deleting a credential is left to admins, and a credential can't be moved out of the project.

Project admin

Everything an editor can do, and manages who has access.

Best for: The lead on a client engagement, who should decide who else joins it.

Adds and removes people on that one project and changes their project role. It doesn't open up any other project, or the rest of the workspace.

On a single project

What each project role can do

Project roles only apply to guests, and only on the project they were given.

Capability	Viewer	Editor	Project admin
On this project
See the project and its details
See every credential in the project
Reveal secrets and 2FA codes in the project
See who else has access
Edit the project's details
Add and edit credentials in the project
Add or remove people and change their project role

Creating or deleting projects, deleting credentials, and managing environments, tags and .env variables stay with the owner and admins - no project role includes them.

Inside the vault

Guests only see what is theirs or what their projects hold

Owners and admins see every vault item in the workspace. Guests see only credentials they created, credentials shared with them, and credentials inside projects they've been added to. Anything outside that scope shows as “not found” - it doesn't even confirm the item exists.

Sharing is deliberate: admins can share any item, and a guest can share only credentials they created. A guest can’t pass on something that was merely shared with them, so access never spreads on its own. Env folders work the same way - a guest sees only the folders shared with them.

Invite the team with the right role

Members are included in every plan. Invite admins or guests, then give each guest Viewer, Editor or Project admin access project by project.

Get started See pricing