A team shares through vaults. Each shared vault has its own key, and each person with access holds their own sealed copy of it. The server stores the vault's items as ciphertext and never holds the key.
Create a shared vault
- Open Teams, then Open next to the team.
- Under Vaults, enter a name (for example
Staging) and choose New vault.
Owners and admins can create vaults. Members can too if the team allows it, and they manage the vaults they create. Every owner and admin can open every vault of the team.
The vault's name is encrypted like its items. The server doesn't know it.
Give people access
Anyone with manage access to a vault can change who opens it. Choose Access next to the vault.
- To add someone, pick a confirmed member under Give a member access…, pick their access, and choose Add. Your app seals the vault key to them.
- To change someone's access, pick a new level next to their name.
- To take access away, choose Remove.
Owners and admins always have manage access, shown as (owner or admin); it can't be changed per vault. Members waiting for confirmation can be added once they're confirmed. You can also offer vaults in the invite itself, applied when you confirm.
Access levels
- Can view
- Use the vault's hosts, keys, tunnels and VPNs, and read its items. Can't change anything; editors say You can use it but not change it, and the sidebar marks the vault view only.
- Can edit
- Also add, change and delete items, attachments and session logs.
- Can manage
- Also see who has access, give and take away access, and rotate the vault's key.
The server enforces these levels. Someone with view access who tries to write anyway is refused.
Putting items in a shared vault
When you can write to more than one vault, the editor for a new host, key, identity, group, snippet, tunnel, VPN or imported scheme shows a Vault choice: Personal (only you) or a shared vault. Items in a shared vault carry the vault's name in the sidebar.
- An item stays in the vault it was created in. To share an existing host, create it again in the shared vault.
- Items can only refer to items in the same vault. A host in a shared vault uses keys, jump hosts, VPNs, identities and groups from that vault, so everyone with access can actually connect.
- A host's terminal scheme travels with it. Give production hosts the Production scheme in a shared vault, and everyone sees the red PROD tab.
Who wrote what
Each item in a shared vault is signed by the member who wrote it, and every app checks that signature against that member's verified key. A server can't forge an item, or pass one off as someone else's.
When someone loses access
Removing someone's access, removing them from the team, or making an admin a member again means they could read what was in those vaults. The vault then shows someone lost access since the key was made, and managers see Rotate key; the sidebar shows Teams · rotate a key.
Rotating seals a new key to everyone who still has access, and re-encrypts the vault's items under it. From then on the person who left can't read anything new. What they already synced stays on their devices, so change the passwords and keys they could see. See Removing members and rotating keys.
Plans
On morphgate.com, changes to a team's vaults need the team's trial or plan. After it ends, members can still read the vaults but not change them until it's renewed. The team's page in the app shows the plan, and seats used. See Plans and billing.