# Recovery and start over

> What to do when a Team Cloud team loses its admins' Macs, how to recover with the Team Recovery Kit, and how to start over when neither an admin's Mac nor the kit is left.

Source: https://docs.subcloak.com/cloak-proxy/team/recovery-and-start-over/

Added in Cloak Proxy 0.7.0.

{/* L9 draft. Sources: PLAN 6.6; T5.5; LAUNCH 4.1 (end-to-end limits). Re-check labels against L6/L8. */}

Only an admin's Mac can approve people and change the team's keys. If every admin's Mac is lost, the team needs its **Team Recovery Kit**. This page covers how to avoid that, how to use the kit, and what's possible without it.

## Avoid it: a second admin

{/* PLAN 6.6 first defence */}

The console's setup checklist asks for a second admin, and any team with one admin shows a standing warning in the console and in the app. Two admins on different Macs make recovery almost never necessary.

## Recover with the Team Recovery Kit

{/* PLAN 6.6; T5.5 (v1) */}

Use the kit when no admin's Mac is left. The owner, or anyone the owner gives the kit to, can do it. That person must be a member of the team or have an invitation: the owner can invite them from the console's **Members** page.

1. On a Mac with Cloak Proxy 0.7.4 or later, sign in to Cloud with your invited or member address in **Settings › Cloud**, then open **Settings › Team**.

2. Under the team, click **No Admin's Mac Left? Recover with the Recovery Kit…** and enter or scan the kit.

3. Before it signs anything, your Mac checks the team's history against the other members' signed checkpoints. With fewer than two other members' Macs to check against, only the code comparison stands, and the app says so: compare the Team Security code with a teammate before you go on. {/* R4D-M3: the recover sheet shows no device list; check Macs in Settings › Team afterwards (step 4) */}

4. Your Mac becomes an admin's Mac. It makes a new team key and opens every restricted space, because each one's key is also sealed to the kit. In **Settings › Team**, check the team's Macs and remove any you don't recognize.

5. Compare the [Team Security code](https://docs.subcloak.com/cloak-proxy/team/team-keys/#the-team-security-code) with a teammate, when your Mac asks.

Recovery doesn't sign anyone else out: the other members' Macs belong to other people and keep working. Admins' Macs show "The Team Recovery Kit was used. Was this you or someone you trust?", and the audit log records it. Make a new kit afterwards if the old one may have been seen by someone else. {/* T5.5 no lockdown */}

> **Why steps 4 and 5 matter:**
> A Mac recovering with the kit has nothing of its own to compare the team's history with, so it relies on the history the server sends. A compromised server working with a Mac that was removed earlier could show it a history in which that Mac is still a member, and recovery would then give that Mac the new team key. The other members' checkpoints, the list of Macs and the Security code comparison are how you catch that. {/* T5.5 v1 residual risk, stated in the docs */}

## No admin's Mac and no kit: start over

{/* PLAN 6.6 no admin and no kit; LAUNCH 4.1 */}

If every admin's Mac and the kit are lost, nobody can change the team's members again, including Subcloak: we don't have the keys. Members' Macs keep working with what they have, but no new person or Mac can join, no one can be promoted, and removing someone in the console cuts off their access without changing the keys.

Starting over isn't in the console yet. The owner writes to [team-support@subcloak.com](mailto:team-support@subcloak.com) from the owner's address. Before we change anything, we check it's the owner: a code we send to the owner's address, and a request from the owner signed in to the console. Starting over keeps the same subscription and makes a fresh set of team keys:

1. We tell you what will happen, and you confirm: nothing is carried over to the new keys automatically.
2. A new admin sets up the new keys on a Mac, as in [Get started](https://docs.subcloak.com/cloak-proxy/team/get-started/#for-the-first-admin-set-up-the-teams-keys).
3. Members re-add what they still have by hand: export it from their Macs before you start (requests, rule and mock sets, sessions) and import it into the new team's spaces. Vault values have to be entered again. Anything nobody exported is lost.
4. We delete the old keys' data from Subcloak's servers by hand within 30 days, and tell the owner when it's done.

> **Caution:**
> Keep the Team Recovery Kit somewhere the company won't lose it, and keep two admins. Without both, starting over can lose spaces for good.

## Related

  - [Team keys and the Recovery Kit](https://docs.subcloak.com/cloak-proxy/team/team-keys/): What the kit can do and where to keep it.
  - [Invite and approve people](https://docs.subcloak.com/cloak-proxy/team/invite-and-approve/): Promote a second admin.
  - [Security model](https://docs.subcloak.com/cloak-proxy/team/security-model/): Why Subcloak can't recover a team.