Team policies

The policies a team owner (and admins the owner allows) can set once the team has turned on team policies. Each policy is signed into the team’s member list, so the sync server cannot change it, and each member’s app checks it. How to set one: Set team policies.

How a policy applies

• No policy leaves the setting to each member. Suggested applies where a member has not set their own. Locked is a floor: members can be stricter, never looser.
• A policy never makes a member’s own setting looser. Where two teams set the same policy, the stricter one applies.
• A connection to a team host takes that team’s policy on every hop, jump hosts from your own vault included.

Who enforces it

Class	What it means
SERVER	Enforced by the Sternway server. A server that is malicious or modified can skip this while showing it as on. Your app compares what the server shows with the signed policy, which catches a misconfigured or outdated server, not a malicious one.
APP	Applied by each member’s app. A modified app can ignore it. The report shows what each device says it applied.

What it covers

Scope	Covers
team-data	This team’s hosts and data
device-gate	This device
account	Your account, for this team’s resources only
server-data	This team’s data on the server

The policies

Require the app lock

lock.required

Turns on the app lock on every member’s device. Applied by each member’s app.

	This policy
Values	On or off; on is stricter
Covers	This device (device-gate)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Member setting it limits	security.appLock
Plan	Business

Lock the app after at most

lock.maxMinutes

The longest a member’s app may stay unlocked while idle, in minutes (1 to 1440). A member’s own shorter time stays.

	This policy
Values	1 to 1440; smaller is stricter
Covers	This device (device-gate)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Member setting it limits	security.autoLockMinutes
Plan	Business

Require two-factor authentication

auth.require2fa

Members need two-factor authentication on their account to use this team’s vaults, statements and reports. Sign-in and personal vaults are never blocked. Enforced by the server.

	This policy
Values	On or off; on is stricter
Covers	Your account, for this team’s resources only (account)
Enforced by	The sync server
Who may change it	The owner, and admins or roles with the policy permission
Plan	Team; also on a self-hosted server without a licence

Require logging in with a passkey

auth.requirePasskey

Who must have signed in with a passkey to use this team’s resources: everyone, or only the owner, admins and roles that sign changes. Enforced by the server. Can’t be combined with Require single sign-on.

	This policy
Values	everyone, signers, off (strictest first)
Covers	Your account, for this team’s resources only (account)
Enforced by	The sync server
Who may change it	The owner, and admins or roles with the policy permission
Plan	Team

Require single sign-on

auth.requireSso

Members sign in to this team through your organisation’s single sign-on. Only the owner changes it.

	This policy
Values	On or off; on is stricter
Covers	Your account, for this team’s resources only (account)
Enforced by	The sync server
Who may change it	The owner only
Plan	Team; also on a self-hosted server without a licence

Log in with keys only, no passwords

hosts.keysOnly

Team hosts log in with keys only: passwords aren’t saved or sent for them. Applied by each member’s app.

	This policy
Values	On or off; on is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Unknown host keys

ssh.hostKeyPolicy

“Refuse unknown keys” never connects to a host whose key is not known yet; “Ask” asks the member first.

	This policy
Values	strict, ask (strictest first)
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

SSH agent forwarding

ssh.agentForwarding

What the SSH agent forwards to team hosts, on every hop: nothing, only the key used to log in, or all keys. Stricter values win over a member’s own setting.

A forwarded agent lets anyone with root on the host use your keys while you are connected.

	This policy
Values	off, auth-key, all-keys (strictest first)
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Allow legacy SSH algorithms

ssh.legacyAlgorithms

Whether connections to team hosts may use old, weaker SSH algorithms (for old devices). Off is stricter.

	This policy
Values	On or off; off is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Export without encryption

export.plaintext

Whether team data may be exported to a file without encryption. Blocked still allows encrypted backups, and a team private key exported or copied with a passphrase; the team owner’s keys leave either way. The team’s hosts are left out of the inventory CSV, and recordings of its hosts are not exported.

	This policy
Values	blocked, allowed (strictest first)
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Clear copied secrets after at most

clipboard.maxClearSec

How long a copied password or key may stay on the clipboard, in seconds (1 to 3600). A member’s own shorter time stays.

	This policy
Values	1 to 3600; smaller is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Member setting it limits	security.clipboardClearSec
Plan	Business

AI assistant

ai.mode

Whether the AI assistant may be used with team hosts: off, only with the approved providers below, or with any provider.

	This policy
Values	off, approved, on (strictest first)
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Approved AI providers

ai.approvedProviders

The addresses (https origins) of AI providers members may use with team hosts when the assistant is limited to approved providers. A provider matches only when its address is exactly one of these.

	This policy
Values	A list of at most 100 addresses (https://api.example.com); a shorter list is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Session sharing

share.mode

Whether members may share a session to a team host: off, read-only, or with control.

	This policy
Values	off, readOnly, on (strictest first)
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Longest session share

share.maxHours

How long a session share may last, in hours (1 to 168).

	This policy
Values	1 to 168; smaller is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Record sessions

recording.required

Every member’s app records sessions to team hosts. Only the owner changes it.

A recording holds everything shown in the terminal. Tell your team before turning this on.

	This policy
Values	On or off; on is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner only
Plan	Business

Allow local shells

localShell.allowed

Whether members may open a shell on their own computer while they use this team’s hosts. Off is stricter.

	This policy
Values	On or off; off is stricter
Covers	This device (device-gate)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Port forwards listen on this device only

forwards.loopbackOnly

Port forwards to team hosts listen only on the member’s own computer, not on its network.

	This policy
Values	On or off; on is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Members may add hosts

hosts.membersMayAdd

Whether members who don’t sign changes may add hosts to the team’s vaults. Enforced by the server.

	This policy
Values	On or off; off is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	The sync server
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Folder sync may include team data

folderSync.teamData

Whether folder sync may write team vaults to a sync folder. Off is stricter.

	This policy
Values	On or off; off is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Longest vault access

grants.maxDays

The longest access to a team vault anyone but the owner may give, in days (1 to 3650). Enforced by the server.

	This policy
Values	1 to 3650; smaller is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	The sync server
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Oldest app version allowed

apps.minVersion

Apps older than this version can’t use this team’s resources until they are updated. Admins can raise it only up to a version other members’ devices already report; the owner’s sessions are never locked out.

A raise applies to existing sessions 24 hours after it is signed; Reports lists the devices it would lock out.

	This policy
Values	A version such as 0.1.0; higher is stricter; not set is off
Covers	Your account, for this team’s resources only (account)
Enforced by	The sync server
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Keep recordings at most

retention.recordingsMaxDays

The longest a member’s device keeps recordings of team sessions, in days (1 to 3650). Admins may only raise it; only the owner lowers it.

A lower value deletes older recordings.

	This policy
Values	1 to 3650
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	Admins may raise it; only the owner may lower it
Member setting it limits	recording.retentionDays
Plan	Business

Keep session logs on the server for

retention.sessionLogsMaxDays

How long the server keeps the team’s session logs, in days (1 to 3650). Admins may only raise it; only the owner adds, lowers or removes it.

A lower value deletes older logs.

	This policy
Values	1 to 3650; larger is stricter
Covers	This team’s hosts and data (team-data)
Enforced by	The sync server
Who may change it	Admins may raise it; only the owner may lower it
Plan	Business

Keep the audit log for

audit.retentionDays

How long the server keeps the team’s audit log, in days: 0 keeps it forever, else at least 30. Admins may only raise it; only the owner adds, lowers or removes it.

A lower value deletes older audit events.

	This policy
Values	0 (kept for ever, the strictest) or at least 30 days; larger is stricter
Covers	This team’s data on the server (server-data)
Enforced by	The sync server
Who may change it	Admins may raise it; only the owner may lower it
Plan	Business

Copy or move items out of the team

items.copyOut

“Only within the team” keeps hosts, keys and snippets from being copied or moved to a personal vault or another team’s, and keeps the team’s private keys from being exported or copied, even with a passphrase. Copying and moving between the team’s own vaults still works, and the team owner can still export keys.

	This policy
Values	sameTeamOnly, allowed (strictest first)
Covers	This team’s hosts and data (team-data)
Enforced by	Each member’s app
Who may change it	The owner, and admins or roles with the policy permission
Plan	Business

Plans

Which plan includes which policy is decided per feature in the code and can change while pricing is not decided; the table above shows the current state. On a self-hosted server the plan comes from its licence file. Without a licence, a self-hosted server gives every team the features that existed before team policies, which include Require two-factor authentication and Require single sign-on. See Licensing of self-hosted servers.