Team Cloud
Remove people and leave a team
Since 0.7.0 Requires Cloak Proxy 0.7.0 or later.
What happens when an owner or admin removes someone from a Team Cloud team, or SCIM deprovisions them, when keys change, what a removed person keeps, and how to leave a team.
Removing someone works in two steps. Subcloak’s server cuts off their access at once. Then an admin’s Mac changes the team’s keys, so nothing written afterwards can be read with the keys the person had.
Remove a person
Section titled “Remove a person”Owners and admins remove people from the console’s Members page (⋯ › Remove…) or from Settings › Team › Members › Remove… on an admin’s Mac. The console asks you to confirm with a passkey or a fresh email code, and says: “Alex loses access now. An admin’s Mac will change the team keys the next time it’s online. Alex keeps anything already downloaded.”
SCIM deprovisioning does the same.
What happens
Section titled “What happens”- At once, on Subcloak’s server. The person’s team sessions end, their Macs are disconnected, and every request they make is refused. This is the immediate protection.
- On the next admin’s Mac that’s online. It removes the person from the team’s signed member list and makes a new team key, sealed only to the Macs that remain. It does this by itself, without asking, because removing someone never widens access. It also makes new keys for the restricted spaces it holds that the person could read.
- On other Macs, at their next sync. Macs that hold the person’s other restricted spaces change those keys too.
Until step 2, the console shows “Access removed. Key rotation waiting for an admin’s Mac”, and the audit log records both steps. If no admin’s Mac comes online within 24 hours, the owner and admins get an email.
The person’s Macs delete their local copies of team data and the team’s keys when they’re told of the removal. That’s best effort: a Mac that’s offline, or a modified app, may not.
What a removed person keeps
Section titled “What a removed person keeps”- Anything they downloaded or copied before the removal. Removal can’t take that back.
- Their own Personal Cloud and local data, which are theirs.
They can’t fetch anything after the removal, and can’t decrypt anything written after the key change. For each vault folder they could open, the Mac that changes the folder’s key says so, naming the person and the items they could read, and asks you to change those secrets at their source. Treat every item in those folders as known to them, and rotate each secret with the service that issued it.
A lost or stolen Mac
Section titled “A lost or stolen Mac”A stolen Mac can act as its owner until it’s cut off. An owner or admin removes the person in the console, which stops every one of their Macs at once and changes the keys as above. The person can then be invited again and rejoin from a Mac they still have, approved by an admin comparing a code.
The last admin
Section titled “The last admin”The console refuses to remove the last admin. SCIM doesn’t check this, so keep at least one admin your identity provider won’t deprovision. If the last admin has left the company, make someone else an admin first. If every admin’s Mac is gone, see Recovery and start over.
Leave a team
Section titled “Leave a team”-
Open Settings › Team (choose the team if you’re in several) and click Leave Team….
-
Confirm. Your Mac removes you from the team’s member list, deletes its copies of the team’s data, the team’s keys and caches, and keeps anything you copied into your own data.
The team’s keys change as for a removal. Leaving needs a connection: Cloak Proxy signs your removal and sends it to the team at once. Offline, Leave Team says it couldn’t reach Subcloak and changes nothing. Your seat is free for an invitation once an admin’s Mac has carried out the change, and stays billed until the owner lowers the seat count.