# Team Cloud

> Team Cloud gives a team shared Cloak Proxy workspaces, rule and mock sets, a secrets vault, reviews and CI, end-to-end encrypted, with SSO, SCIM and an audit log.

Source: https://docs.subcloak.com/cloak-proxy/team/overview/

Added in Cloak Proxy 0.7.0.

{/*
  L9 draft for docs.subcloak.com. Claims rest on docs-drafts/team/PLAN.md; each block names its section.
  Re-check every UI label against the merged L8 code before applying (LANES L9 "Re-check against the merged code").
*/}

Team Cloud is the paid plan for teams that work on the same apps and APIs. It gives everyone shared API workspaces, rule sets and mock sets that update live once a manager approves each change, a secrets vault with per-person access, reviews for protected changes, a team session library and CI access, all end-to-end encrypted. A web console at `console.subcloak.com` handles billing, members, SSO with OIDC (SAML coming later), SCIM, policies and the audit log.

{/* PLAN 0, 1.1, 7 */}

Cloak Proxy itself stays [free for life](https://docs.subcloak.com/cloak-proxy/getting-started/free-for-life/). Team features appear only for people who join a team, and the free app never needs an account. {/* PLAN 1 principle 6 */}

## What your team gets

  **Shared workspaces and sets**

    Team API workspaces, rule sets and mock sets, with live updates and no Git needed. Each person chooses which rule and mock sets apply on their Mac. See [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/).

  **A vault with per-person access**

    Secrets in vault folders that only the people you add can open. Requests use them as `{{vault:team/NAME}}`. See [Team vault](https://docs.subcloak.com/cloak-proxy/team/vault/).

  **Reviews for protected sets**

    Changes to a protected rule or mock set become proposals that a manager approves. See [Protected sets and reviews](https://docs.subcloak.com/cloak-proxy/team/protected-sets/).

  **CI that uses your team's sets**

    `cloakctl` applies team mock and rule sets in a CI job and uploads the recording to the team library. See [CI with cloakctl](https://docs.subcloak.com/cloak-proxy/team/ci/).

{/* PLAN 7.1–7.19: the 19 rows of the website's Team card, in order. */}

| Feature | Where to read more |
|---|---|
| Team workspaces, with live updates and no Git needed | [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/) |
| Shared rule sets and mock sets | [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/#rule-sets-and-mock-sets) |
| Roles and per-workspace permissions | [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/) |
| Secrets vault with per-person access, end-to-end encrypted | [Team vault](https://docs.subcloak.com/cloak-proxy/team/vault/) |
| Comments and @mentions | [Comments and notifications](https://docs.subcloak.com/cloak-proxy/team/comments/) |
| Team session library with tags | [Library and Findings](https://docs.subcloak.com/cloak-proxy/team/library-and-findings/) |
| Review and approve changes to protected rule and mock sets | [Protected sets and reviews](https://docs.subcloak.com/cloak-proxy/team/protected-sets/) |
| Team Findings and Report Bug to the team | [Library and Findings](https://docs.subcloak.com/cloak-proxy/team/library-and-findings/#team-findings) |
| CI recordings from cloakctl, and CI access to team sets | [CI with cloakctl](https://docs.subcloak.com/cloak-proxy/team/ci/) |
| Live pair debugging | [Pair debugging](https://docs.subcloak.com/cloak-proxy/team/pair-debugging/) |
| Shared monitors with Slack, PagerDuty and Opsgenie alerts \* | [Monitors](https://docs.subcloak.com/cloak-proxy/team/monitors/) |
| Hosted team mocks \* | [Hosted mocks](https://docs.subcloak.com/cloak-proxy/team/hosted-mocks/) |
| Shared MCP servers and agent setups (never keys) | [Shared agent setups](https://docs.subcloak.com/cloak-proxy/team/agent-setups/) |
| Admin policies | [Policies](https://docs.subcloak.com/cloak-proxy/team/policies/) |
| 1-year audit log | [Audit log](https://docs.subcloak.com/cloak-proxy/team/audit-log/) |
| 90-day version history | [Version history](https://docs.subcloak.com/cloak-proxy/team/version-history/) |
| SSO and SCIM at no extra charge | [Single sign-on](https://docs.subcloak.com/cloak-proxy/team/sso/) (OIDC; SAML coming later), [SCIM](https://docs.subcloak.com/cloak-proxy/team/scim/) |
| Onboarding call (10+ seats, yearly) | [Support and onboarding](https://docs.subcloak.com/cloak-proxy/team/support/) |
| First support reply within 1 business day | [Support and onboarding](https://docs.subcloak.com/cloak-proxy/team/support/) |

{/* PLAN 1.1 principle 1, 7.11, 7.12, T14 */}

> *** Not end-to-end encrypted:**
> Monitors and hosted mocks run on Subcloak's servers, which read them. Nothing goes to them until someone publishes a monitor or a mock set from Cloak Proxy, item by item, after a warning. Everything else your team syncs is end-to-end encrypted.

## How your team's data is protected

{/* PLAN 1.1, 3.4, 5 */}

- **End-to-end encrypted.** Team data is encrypted on members' Macs before it's uploaded. The keys are on members' Macs, on the CI tokens admins create (for the spaces they're given) and on the team's printed Team Recovery Kit, never on Subcloak's server. Subcloak can't read your team's workspaces, rule and mock sets, library, Findings, comments, agent setups or vault, or their names. With [automatic approval after SSO](https://docs.subcloak.com/cloak-proxy/team/invite-and-approve/#approve-macs-automatically-after-sso) turned on, Subcloak's server and your identity provider can admit a Mac as an existing member; it's off unless an admin turns it on.
- **Every Mac checks the server.** Who is in the team, their roles, which Macs are theirs, who can open each restricted space and who approved a protected change are all signed by members' Macs. A Mac refuses anything the team didn't sign, so the server can't add a person, raise a role or approve a change.
- **A person approves every new Mac.** By default, a person's first Mac joins only after they and an admin compare a 6-digit code, and each further Mac after they compare one with a Mac of their own. Signing in, even with SSO, never gives a Mac the team's keys, unless an admin turns on automatic approval after SSO.
- **The console holds no keys.** An owner or billing manager can run billing, seats and settings without being able to read the team's data, as long as automatic approval after SSO is off. Anything that needs a key, such as approving a member, is done by an admin's Mac.

What Subcloak can see, such as members' emails, roles and activity times, is listed on [What Subcloak can and can't see](https://docs.subcloak.com/cloak-proxy/team/what-subcloak-can-see/). The design and its limits are on [Security model](https://docs.subcloak.com/cloak-proxy/team/security-model/).

## Who does what

{/* PLAN 3.1, 3.3 */}

| Role | Needs a seat | What they do |
|---|---|---|
| **Owner** | No (optional) | Buys the team and has every console control: billing, seats, members, policies, SSO and SCIM, the audit log and deletion. One per team. |
| **Billing manager** | No | Billing, invoices and seat count, in the console. |
| **Admin** | Yes | Approves new members' first Macs, invites and removes people, sets policies, SSO and SCIM, and creates CI tokens. Manages every open space. |
| **Member** | Yes | Uses the team's spaces in Cloak Proxy at the role each space gives them. |

See [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/#team-roles) for the details.

## Pricing

{/* PLAN 6.1, 8.1, 8.3; LAUNCH 3.2 */}

| Plan | Price |
|---|---|
| **Team monthly** | $5 a seat a month |
| **Team yearly** | $48 a seat a year ($4 a seat a month) |

- **At least 2 seats.** Each seat is one named person who uses Cloak Proxy with the team. Owners and billing managers who don't use the app, and CI tokens, don't take a seat.
- **Plus local tax,** in US dollars. You buy in the console, and pay on the checkout page of Polar, our merchant of record.
- **No free trial.** A full refund of any team payment within 30 days, on request. See [Billing and seats](https://docs.subcloak.com/cloak-proxy/team/billing-and-seats/#refunds).
- **A Team seat doesn't include Personal Cloud,** and a Personal Cloud subscription doesn't count as a seat. They're separate purchases. {/* PLAN 11, OQ1 */}

## Team Cloud and Personal Cloud

{/* PLAN 11 */}

A person can use [Personal Cloud](https://docs.subcloak.com/cloak-proxy/cloud/overview/) beside any number of teams. Each has its own keys, and nothing moves between them unless the person chooses **Copy to Team…** or **Copy to Personal**, which copy (never move) and strip secrets as sync does. Leaving a team, or being removed, affects only that team's data on the Mac.

| | Personal Cloud | Team Cloud |
|---|---|---|
| For | One person's own Macs | A team |
| Bought | In the app, **Settings › Cloud** | In the console, `console.subcloak.com/start` |
| Price | $3 a month or $25 a year | $5 a seat a month, or $48 a seat a year |
| Share links | Yes | No (share links are part of Personal Cloud) |
| Shared spaces, vault, reviews, CI, SSO, SCIM, audit log | No | Yes |

## Requirements

{/* PLAN 2, 7.9; VERIFY(L7): the Linux cloakctl build that carries the team commands, and where it's downloaded. */}

- **Cloak Proxy 0.7.0 or later** on a Mac with macOS 14 or later, for everyone who takes a seat.
- **A web browser** for the console. An owner or billing manager who doesn't take a seat needs nothing else.
- For CI, `cloakctl` 0.7.0 or later on a macOS runner. The Linux `cloakctl` gets the team commands in a later release.

## If your organization manages your Macs

{/* PLAN 1 principle 6, 11 */}

`CloudDisabled` turns off Personal Cloud and Team Cloud together. `CloudPersonalDisabled` turns off only Personal Cloud, so people can use the team without a personal account syncing beside it. See [Deploy to a team](https://docs.subcloak.com/cloak-proxy/getting-started/deploy-to-a-team/).

## Related

  - [Get started](https://docs.subcloak.com/cloak-proxy/team/get-started/): Buy a team, set up its keys and invite people.
  - [What Subcloak can and can't see](https://docs.subcloak.com/cloak-proxy/team/what-subcloak-can-see/): Exactly what our servers hold for a team.
  - [Billing and seats](https://docs.subcloak.com/cloak-proxy/team/billing-and-seats/): Prices, seats, proration and refunds.
  - [Security model](https://docs.subcloak.com/cloak-proxy/team/security-model/): Keys, roles, who enforces what, and the limits.