Team roles and what each one can do

Organisation → Team. Every member has a role, and the role is what they can do.

The roles

Owner — everything, including billing, cancelling and removing other owners. There is always at least one. Administrator — everything operational: sites, domains, DNS, backups, team. Cannot change the plan or the payment method. Member — day-to-day work on sites: deploys, updates, backups, logs. No billing, no team, no destructive account-level actions. Billing — invoices, payment methods and the plan, and nothing about the sites. Read-only — can see, cannot change. Useful for a client who wants visibility.

Giving somebody one site rather than all of them

Do not use a team role for that. Use Site access — an SFTP or SSH credential scoped to that one site, which a contractor can use without an account here at all. Revoking it affects nothing else.

What is logged

Every privileged action, under the name of the person who did it, in Activity. That is the reason to add people as themselves rather than sharing one login: a shared account tells you that something happened and not who did it.

Removing somebody

Removal is immediate and ends their sessions. Anything they created stays — sites, tickets and API keys belong to the organisation, not to the person — but their API keys are revoked with them.