Teams
Share vaults, not passwords.
A team owns shared vaults of hosts, keys, tunnels and VPNs. Each person gets view, edit or manage access and a copy of the vault key sealed to them, so the server never holds one.
A new team starts with a 7-day trial that includes every Business feature. Team and Business start at 3 seats.
Shared vaults
Access per vault, sealed by the app, enforced by the server.
Each shared vault has its own key. Giving someone access seals that key to them from your app, and the server refuses writes from anyone who may only view.
A host in a shared vault uses keys, jump hosts, VPNs and identities from the same vault, so everyone with access can actually connect. Its terminal scheme travels with it: give production hosts the Production scheme, and everyone sees the red PROD tab.
Each item is signed by the member who wrote it. No one, the server included, can forge an item or pass it off as someone else’s.
| Access | What it allows |
|---|---|
| Can view | Connect with the vault’s hosts, keys, tunnels and VPNs, and read its items |
| Can edit | Also add, change and delete items, attachments and session logs |
| Can manage | Also give and take away access, and rotate the vault’s key |
| Owner or admin | Manage every vault of the team |
Your personal vault stays yours. Nobody in a team, owners included, can open it.
Roles
Three roles, one owner.
Owner
One per team. Everything an admin does, plus admins’ invites and roles, the plan and seats, handing the team over, and deleting it.
Admin
Opens and manages every vault. Invites, confirms and removes members, sets policies and reads the activity log.
Member
Opens the vaults they were given, with view, edit or manage access to each. Creates vaults if the team allows it.
Joining
New members are checked by fingerprint.
Every account has a fingerprint: 32 characters made from its public keys. When an admin confirms someone, their app seals the vault keys to the keys the server shows. Reading the fingerprint aloud on a call proves those keys are really that person’s, so the server can’t slip in keys of its own.
The same check the other way round proves to the new member that they are joining the team they think.
| Step | What happens |
|---|---|
| 1. Invite | An owner or admin invites an email address from the app or the team page, and can offer vaults with it. The invite works once, for 7 days. |
| 2. Accept | The person pastes the code into the app and compares the owner’s fingerprint before joining. |
| 3. Confirm | An admin compares the new member’s fingerprint and confirms them. Only then do they get vault keys and take a seat. |
Offboarding
When someone leaves, the app walks you through it.
Removing someone stops their sync. Four steps make sure that what they knew stops working too.
Step 1
See what they could open
Each vault they had access to, with their access, and how many hosts, SSH keys and VPNs it holds.
Step 2
Remove them and rotate
Every one of those vaults gets a new key, sealed to everyone who stays. From then on the server refuses changes made with the old key.
Step 3
Take their keys off your servers
MorphGate signs in to every host in the team’s vaults, finds the SSH keys they published in ~/.ssh/authorized_keys, and removes them over SFTP.
Step 4
Change what they saw
A checklist of every password, key and VPN profile they could read. For a shared SSH key, Replace key installs a new one on every host, tries it, switches the vault, then removes the old one.
Policies
Rules for the team’s vaults, never for anyone’s own.
A member who doesn’t meet a policy keeps the team’s vaults already on their devices; they just don’t sync until they do. Losing a plan never quietly switches a policy off.
Two-step verification
Members without it keep their personal vault, but the team’s vaults wait until they turn it on.
Invite domains
Invites go only to addresses at the domains you list, such as your company’s.
Who creates vaults
Only owners and admins by default. Let members create vaults, and they manage the ones they make.
Session log retention
The server deletes the team’s session recordings after the number of days you set, from 1 to 3650.
Business
Device approval
New devices wait for approval before they open the team’s vaults.
Business
Single sign-on
The team’s vaults also need a recent sign-in at your identity provider.
Activity log
Who did what, without what’s inside.
Owners and admins read the team’s log in the app or on the team page, and download it as CSV or JSON lines. It records invites and joins, roles, vault access, key rotations, policy changes, device approvals and single sign-on.
Each event keeps the IP address it came from. It can’t record which hosts anyone opened or what they ran, because the server never sees it. Kept for a year on Team and three years on Business.
| When | What happened | From |
|---|---|---|
19 Oct 11:43 | Ana rotated the Staging key (generation 2) | 203.0.113.24 |
19 Oct 11:43 | Ana rotated the Production key (generation 5) | 203.0.113.24 |
19 Oct 11:42 | Ana removed jelena@acme.example | 203.0.113.24 |
18 Oct 16:05 | Ana approved Marko’s new device (macOS) | 203.0.113.24 |
18 Oct 09:30 | Marko signed in with single sign-on | 198.51.100.7 |
17 Oct 14:12 | Policy changed: invites only to acme.example | 203.0.113.24 |
Business
For teams that sign in through an identity provider.
Business adds these to Team, along with team session logs and three years of activity log. A new team’s trial includes all of them.
Single sign-on
OpenID Connect or SAML 2.0, with Microsoft Entra ID, Okta, Google and others. A device opens the team’s vaults only after a recent sign-in there. It adds to the master password and never replaces it.
SCIM provisioning
Assign someone in your identity provider and they are invited. Deactivate them and they are removed, their access is taken away, and their vaults are flagged for a key rotation.
Device approval
A new device waits until an admin, or one of the member’s own approved devices, approves it. A stolen master password alone doesn’t open the team’s vaults.
Audit stream
Every activity event is posted to your SIEM as signed JSON as it happens. If your endpoint is down, delivery is retried for about a day.
Seats and trials
Each confirmed member takes a seat, the owner included, and the seat covers their personal vault too. Team and Business start at 3 seats. You can invite more people than you have seats, and confirm them once you add seats.
A new team starts with a 7-day trial with every Business feature, once per address.
Managed in the app, where the keys are
Confirming members, giving access and rotating keys need vault keys that only your app holds, so they happen in the app.
The plan, seats, single sign-on, SCIM and the audit stream are on the team page at morphgate.com, which never sees inside a vault.