Get started with Team Cloud

A team is set up in three steps, often by three different people: the owner buys it in the console, the first admin sets up the team’s keys on a Mac, and members join from Cloak Proxy. One person can do all three.

For owners: buy a team

You don’t need a Mac or a seat to buy and run a team. The console never holds the team’s keys, so you can manage billing and people without being able to read the team’s data (unless an admin turns on automatic approval after SSO, which lets your identity provider admit a Mac).

1. Go to console.subcloak.com/start (or Start a team on subcloak.com) and sign in with your email. The console emails a 6-digit code. If you already use Personal Cloud, it’s the same sign-in.

2. Fill in Start a team:

   • Team name.
   • Seats: at least 2. Each person who’ll use Cloak Proxy with the team takes one.
   • Billing: Monthly, $5 a seat, or Yearly, $4 a seat a month ($48 a seat a year).
   • I’ll use Cloak Proxy myself (takes a seat): on by default. Turn it off if you only run billing and settings.

   The total is shown on one line, for example “3 seats × $48 = $144 a year, plus tax. Billed by Polar.”

3. Click Continue to payment and pay on Polar’s checkout page.

4. The console’s welcome page says “Payment received. Next, set up the team’s keys on a Mac” and offers two choices:

   • I’ll do it: download Cloak Proxy, sign in with the same email, then Settings › Team › Set Up Team Keys. See For the first admin.
   • Invite the first admin: send an admin invitation to the person who’ll set up the keys.

The console’s Overview shows a Setup checklist until it’s done:

1. Keys set up on a Mac
2. A second admin
3. Team Recovery Kit stored (an admin’s Mac reports it)
4. Invite your team
5. SSO (optional)

Ask for a second admin early

Only an admin’s Mac can approve new people. A team with one admin shows a standing warning in the console and in the app until a second admin joins. See Recovery and start over.

For the first admin: set up the team’s keys

The first admin is the owner (if they took a seat) or the person who accepted an admin invitation. Whoever sets up the keys first becomes the team’s first admin; anyone else who tries afterwards joins the normal way and waits for approval.

1. Install Cloak Proxy 0.7.4 or later and sign in to Cloud with the invited email in Settings › Cloud. Only someone invited as an admin can set up the keys (the owner is, if they chose “I’ll do it” in the console: that uses one of the team’s seats).

2. In Settings › Team, the team says it needs its keys. Click Set Up Team Keys. Your Mac makes the team’s keys and its Team Recovery Kit. Until this is done nobody can join, and most of the console waits for it.

3. Save or print the Team Recovery Kit: “Store it where your company keeps critical secrets. Whoever holds it can recover the team and read all its data.” See Team keys and the Recovery Kit.

4. Cloak Proxy creates the team’s first spaces: Team rules, Team mocks, Library, Findings and Agents. It asks whether to create a first vault folder.

5. Invite a second admin and your team. See Invite and approve people.

For members: join a team

1. Open the invitation email: “Priya Shah invited you to Acme on Cloak Proxy.” It has a Join link and a download link. The invitation holds no secret: it only lets your address ask to join.

2. Install Cloak Proxy 0.7.4 or later, and sign in with the address the invitation went to, by email code, or with SSO if your team requires it.

3. Click the link in the email, or open Settings › Team, and click Join. Your Mac asks the team’s admins to approve it.

4. An admin contacts you on a call or in chat and reads you a 6-digit code. Check it matches the code on your Mac, then click Codes Match. Don’t click it if the codes differ.

5. Your Mac receives the team’s keys and syncs the team’s spaces. They appear in the sidebar under Team: Acme.

If no admin has set up the team’s keys yet, Settings › Team says “Acme isn’t set up yet”, with no Join button: there’s nothing to do until its first admin has set up the keys. Check Again looks for them.

A request to join lasts 10 minutes. Ask an admin to open Settings › Team on their Mac when you click Join (admins also get a notification). If nobody approves it in time, Settings › Team says so and you can click Join again.

Your second Mac joins the same way: once you’re signed in, Settings › Team says “This Mac isn’t in Acme yet”. Click Add This Mac, and approve it from your first Mac after comparing a code there. An admin’s Mac approves only a person’s first Mac. A team allows up to 5 Macs per person, or fewer if a policy says so.

Where things are

In Cloak Proxy	What it’s for
Settings › Team	The team, this Mac, join requests, members, security (Team Security code, Recovery Kit), policies, CI tokens, notifications and server-side features. With several teams, a picker at the top.
Sidebar Team: Acme	Workspaces, Rules, Mocks, Library, Findings, Vault, Agents, Reviews and Monitors*. A lock marks a restricted space; a shield marks a protected set.
Toolbar	The plan pill (“Team · Acme”), Activity (notifications) and Pair.
Team menu	Open Console, Library, Reviews, Vault, Pair…. Before your Mac is in a team, only Open Console and Team Settings….
Help › Contact Team Support	An email to team support with your team’s code.

In the console	What it’s for
Overview	Plan, setup checklist, items that need attention, recent activity.
Members	People, roles, seats, invitations and removals.
Billing	Seats, interval, payment method and invoices.
Policies, SSO & SCIM, CI, Monitors*, Hosted mocks*, Usage, Audit log, Settings, Support	As named.
Your account	Your passkeys, sessions and notification preferences.

Related

Invite and approve peopleInvitations, join requests and comparing codes.

Team keys and the Recovery KitWhat the keys are and where to keep the kit.

Spaces, roles and permissionsOpen and restricted spaces, and who can do what.

Billing and seatsSeats, proration and refunds.