Team, roles, and invitations
How team membership works in CertShield, what each role can do, and how to invite or remove people.
CertShield supports multi-person teams on Pro and Business plans. Everything team-related lives on the Team page.
The three roles
There are three roles. Every member has exactly one.
Owner
- Full access to everything.
- The only role that can manage billing and transfer ownership.
- Every organization has exactly one owner. Transferring ownership moves it to another member — see Transferring ownership.
- Cannot be removed directly; you have to transfer ownership first.
Admin
- Full access to day-to-day operations: domains, certificates, endpoints, alerts, team management, settings, audit log.
- Cannot access billing.
- Can invite and remove members and admins, but can’t promote someone to owner.
Member
- Read and write access to domains, certificates, endpoints, and alerts.
- Can see the team list but can’t invite, remove, or change roles.
- Cannot see the audit log or billing.
Inviting someone
- Go to the Team page.
- Enter the person’s email address and pick a role (Member or Admin).
- Click Invite.
CertShield sends them an email with a secure invite link. Once they click it, they either sign up fresh or accept into your organization if they already have an account.
Plan limits
Each plan has a cap on how many users can be in one organization. Hobbyist and Startup are solo plans — they don’t support additional users. Pro supports up to 5 users, Business up to 20. See Plans & pricing for current numbers.
If you’re at your limit, the Invite form is disabled and tells you how to make room: remove someone or upgrade.
If the invite email doesn’t arrive
CertShield also shows pending invitations in-app to any user who signs in with the invited email. So if someone signs up separately and doesn’t see the email, they can still accept from the dashboard banner.
Changing someone’s role
From the Team page, use the role dropdown next to a member’s name. Owners can promote members to admin and demote admins back to member. Admins can do the same except they can never create or demote another admin — only owners can.
You can’t change your own role. If you’re the owner and want to step down, use Transfer ownership instead.
Removing someone
Click Remove on a member’s row and confirm. The person immediately loses access to your organization — their access token is invalidated within moments and their next sign-in lands them in a fresh, empty personal organization, not yours.
All the data they contributed (domains they added, settings they changed) stays in your organization. Only their membership is removed.
Ownership transfer
Only the owner can do this, and only if there’s at least one other member to transfer to. Open Team, click the Transfer Ownership button, pick the new owner from the list, and confirm. You’ll be demoted to admin in the same step. This can’t be undone without the new owner transferring it back.
What members see
Members have a different left navigation than owners and admins — some menu items (Audit Log, Billing) are hidden entirely. This is intentional; there’s nothing they could do on those pages anyway.