Team, seats, sign-ins, and the audit log
Who can do what in an organization, how seats are counted and charged, and what the audit log and sign-in history record.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
Everything belongs to an organization: sources, rules, findings, Leak Alarm, API keys, billing, and members. The plan belongs to the organization.
Roles
| Role | Can do |
|---|---|
| Owner | Everything, including billing, deleting the organization, and changing roles |
| Admin | Everything except deleting the organization and transferring ownership |
| Member | Sources, rules, findings (acknowledge and resolve), and Leak Alarm |
| Viewer | Read only; any API key a viewer uses can only read |
Roles are enforced on the server. API keys can never perform owner or admin actions.
Seats
| Plan | Seats included |
|---|---|
| Starter | 5 |
| Pro | 10 |
| Business | Unlimited |
- Invites use included seats first, at no charge. On Starter and Pro, buying a seat is offered once they are all taken.
- An extra seat costs the plan price, on your billing cycle. Business never needs one.
- Someone who already pays for their own organization on your plan or higher joins without taking a seat.
- Removing a member frees the seat at once. To pay for fewer seats, email support@shellorbit.com.
Audit log
Every change to configuration or access, with who and when: sources, rules, finding status, API keys, members and roles, domains, plans, and subscriptions. It records actions, never payloads. Changes made by AI agents through MCP show MCP as the actor.
Sign-in history
Every sign in, wrong password, wrong code, and sign out: when, how, the IP address, browser and operating system, and an approximate city, region and country where available. Owners and admins see everyone; others see their own. VPNs and proxies show their own location.
Current sessions are listed at the top, each with device, address, and location. Sign out any one, or all but your own.
History by plan
| Plan | Audit log and sign-in history | CSV export |
|---|---|---|
| Starter | Last 60 days | No |
| Pro | Last 90 days | Yes |
| Business | Last year | Yes |
Everything is recorded on every plan, so upgrading shows the longer window at once. Records are deleted a little over a year after they are made.