Members and roles

A tenant knows exactly two roles. Whoever is removed loses access immediately — not at their next sign-in.

The two roles

Role	May
Owner (interface: Owner)	everything — invite, remove, change roles, rename the tenant, manage API keys, change the plan
Member (interface: Member)	work with the tools, use the archive and master data, view the member list

Every member may see the list of members. Inviting, removing, changing roles and renaming are owner rights and are checked on every submission — being signed in is not enough on its own.

How the first tenant comes about

When a new address signs in for the first time, a personal tenant is created automatically, named after the local part of the email address (erika@firma.de → erika); that user is the owner there. You change the name on the members page, up to 120 characters.

Invitations

An invitation consists of an entry in the invitation list and an email with a magic link that also carries the tenant and the role. When it is redeemed, the membership is created — and the invitee is signed in at the same time.

Behaviour	Effect
Inviting the same address again	updates the role and the inviter, creates no second entry
The address is already a member	rejected: “This address is already a member of this tenant.”
Withdrawing an invitation	deletes the open entry; one already redeemed remains
An invitation stays open for a long time	nightly cleanup removes unaccepted invitations after 30 days

Seats = members + open invitations

The check runs against the plan’s seat count before the invitation is written. So an open invitation already occupies a seat. Anyone at the limit withdraws an old invitation first.

Withdrawing rights applies at once

Membership is read afresh from the database on every single request — not from the sign-in cookie and not from a cache. Whoever is removed has no access with their next click, even with a 30-day session still valid.

The last owner cannot be removed

Neither removed nor demoted to member — that would leave the tenant orphaned. Both attempts are rejected with “The last owner cannot be removed.” If ownership is to change, make someone else an owner first.

How many seats the plan allows

See Plan, quotas and the format gate. In the Enterprise installation no limit applies.