Organisations, roles, contacts and ownership
Who in your team can do what, who gets which emails, and how to hand an organisation to someone else.
Built, not open to the public yet
This feature is built and has been tested against simulated hosts and a test database. It has not yet been proven on real hardware, and nothing here can be ordered today.
Not there yet
- Pages that draw controls from the built-in roles still show custom-role members read-only controls.
Organisations and members
Servers, billing and keys belong to an organisation. Every account has a personal organisation. You can create others and invite people by email. An invitation is a grant: the person who sends it must hold every permission the role gives, and that is checked again when it is accepted.
Built-in roles
| Role | Can |
|---|---|
| Owner | Everything, including ownership and deleting the organisation. |
| Admin | The same permissions as an owner, except granting or removing ownership. |
| Member | Manage servers and game servers, SSH keys, ISOs and tickets; see billing. No billing changes, no destroying servers, no team management. |
| Billing | See servers; manage billing; use tickets. |
| Viewer | Read servers, billing, keys and game servers. Change nothing. |
Custom roles
A non-personal organisation can define up to 20 roles of its own: a name of 1 to 40 characters, an optional description and a list of permissions. A member holds one built-in role or one custom role.
- A role can contain only permissions the person editing it holds, so nobody can grant what they lack.
- Nobody can change or remove a member who holds a permission they do not.
- Owner is never a custom role. A role that is in use cannot be deleted.
- Changing a role changes everyone who holds it at once. Editing and deleting need a recent password check.
Known limit: some panel pages decide what to show from the built-in role names, so a custom-role member may see read-only controls where they actually have permission. The server decides what is allowed.
Contacts
Up to 10 contacts per organisation: an email address, an optional name and the kinds of notice it gets: billing, technical or security. A contact need not have an account. An address is used only after its owner opens the link we email to it (valid for 7 days, once). The address cannot be edited: add a new contact instead. Adding a kind the person did not confirm asks them to confirm again.
Billing contacts get payment and usage notices, technical contacts get server and webhook notices, and security contacts are told when our staff looked into the organisation. To protect third parties there are limits on how many confirmation emails one address or one organisation can be sent in a day.
Transfer ownership
- An owner offers the organisation to one active member with a confirmed email. The offer lasts 72 hours and only one is open at a time. The giver picks the role they will keep (admin, member, billing or viewer).
- Both sides confirm with a recent password check. The recipient is emailed and answers in their own account under Account, Transfers. The email carries no link, so a forwarded email is useless.
- Accepting makes the recipient an owner first and only then gives the giver their new role, so the organisation always has an owner. The giver or any owner can cancel; the recipient can decline.
Billing does not move. Saved cards, credit and servers stay on the organisation, so renewals keep charging the cards on file until the new owner changes them. Both sides must tick that they understand this. If you want your own card gone, remove it before you hand over. Billing notices go to the owners and billing members.
Require two-factor
Owners can require two-factor for all members. See account security.