People

Each person makes their own key with a one-time code. Nobody else ever sees their key.

People

PersonGroupNode managerCardLast data uploadStatusKeys and actions

A new code can be issued only while the person has no key. Once someone has claimed their key, you can end it only by marking them as left.

Add person

Invite a manager

The node stays when its manager leaves. The parent invites a replacement. Keys bind to the node and never grant a wider branch.

New-person handoff

Creating a person does not count them toward the privacy floor.

Existing keys are Stored (not shown).

Keys

History and retention

Mark as left revokes all personal, device and node keys and closes membership now. Work from their time here stays in team totals.

Erase personal data is a separate, top-level admin action that keeps name-free totals.

People and key audit

When (UTC)ActionBySubject