Account and team_

Roles

Can…	Owner	Admin	Member	Billing	Read-only
Create, change and delete machines, apps, databases, DNS and SSH keys; use the browser console and SQL editor; reveal passwords	Yes	Yes	Yes	No	No
Invite and remove people, change their roles	Yes	Yes	No	No	No
Cards, invoices, invoice details, spending alert	Yes	No	No	Yes	No
Workspace name, required two-factor, default role	Yes	Yes	No	No	No
Transfer ownership	Yes	No	No	No	No

Everyone can see everything in the workspace and manage their own profile, password, two-factor, sessions and notifications. Read-only is for auditors and dashboards. Admins can't change or remove an owner. Owners must use two-factor authentication; Require 2FA on Team extends that to everyone.

Team

Settings → Team lists everyone, their role, whether they use two-factor and when they were last active. Owners and admins invite people by email with a role (the link lasts 7 days; Resend sends a new one), change roles, and remove access. Removing a person ends their sessions and API tokens; it does not remove SSH keys already on machines. To hand the workspace over, the owner uses Transfer ownership on someone's row and becomes an admin.

Profile and notifications

Settings → Profile: your name, your email (changing it sends a link to the new address and tells the old one; nothing changes until the link is used), and your theme. The theme is your default in any browser; the sun/moon button in the top bar switches just the browser you're on.

Settings → Notifications chooses what we email you: something stopping responding, your spending alert, credit about to expire, and sign-ins from a new browser. Invoice and payment emails always go to the owner and the Billing role.

Security: two-factor, password, sessions

Settings → Security:

• Password: at least 15 characters. Changing it signs out every other session. We never email passwords.
• Two-factor authentication: scan the QR code with an authenticator app, save the recovery codes, and enter the current code. Replace starts again with a new secret, for a new phone.
• Recovery codes: the page shows how many are left. Regenerate makes a new set (shown once) and the old ones stop working.
• Sessions: each browser you're signed in on, with its network and when it was last used. Sign one out, or all except this one.
• Recent sign-in activity: successful sign-ins and refused attempts on your account.

If you lose your authenticator and your recovery codes, contact support from the email address on the account; we will verify who you are before resetting anything.

SSH keys

Settings → SSH keys holds the public keys offered when you create a machine. Add a key with a name and the public key text; the list shows each key's fingerprint, which machines it's on, and when it was last used to build one. Removing a key stops it being offered for new machines but does not remove it from machines it is already on; do that inside the guest.

Only public keys go here. Never paste a private key into Fresh or send one to support.

Actions that need a recent sign-in

Creating billed resources, enabling the browser console, revealing app or database passwords, and other sensitive actions ask you to re-enter your password and authenticator code if you last signed in more than 15 minutes ago. This limits what a forgotten open browser can do.

Activity

Activity, on the right of the top bar, lists everything done in the workspace, one row per action: creating an app is one row, not five events. Open a row to see each step, how long it took, and the browser session it came from. Rows say who did it (a person, or Fresh for automatic work), and carry a grey Security tag for sign-ins, keys and password reveals, an amber Needs a look for things worth reading (a blocked sign-in, an app Fresh stopped restarting) and red for failures.

Search, pick a category (machines, apps, databases, DNS, account and team, billing, security), a person or Fresh automation, and a period (24 hours, 7 days, 30 days or your own dates). Times switches between UTC and your own time zone. Export CSV downloads what you're looking at; each row's JSON link shows the records behind it. Records are kept for the life of the account, even after the resource is deleted.