Halaman ini belum tersedia dalam bahasa Anda. Anda membaca teks bahasa Inggris.
For agencies
For agencies
- 5
- Roles, from member to owner
- $3 / mo
- One extra team seat
- 3
- Seats in Business, the owner among them
- 62
- Named event kinds in the log
An agency loses accounts on people
Twelve clients, four people, one spreadsheet of logins. It holds until somebody opens the wrong account from the wrong machine.
A spreadsheet cannot refuse. It cannot say who opened a client's account last night, and it cannot take the access back when a contractor moves on.
How agencies hold this today
The usual arrangements are made of trust and habit, and they work while the team is small.
What they leave shared is the part that costs money later: one machine, one password, one list nobody can audit.
| Arrangement | Holds while | What it cannot do |
|---|---|---|
| A spreadsheet of logins | Nobody leaves | Take the access back, or say who used it |
| One shared laptop | One person works at a time | Let two people work without meeting |
| A browser profile each | Every account is your own | Keep a client's cookies off a personal machine |
| Passwords in a chat | The chat stays private | Expire, or stop travelling further |
| One ARMANOS workspace | The subscription is paid | Decide how a site judges a profile |
A seat is a person
Seats are counted per person, not per machine. Business includes three, you among them, and an extra seat is three dollars a month.
The person you invite must already have an account, because ownership of an address is not checked at the invitation. The invitation lives seven days and can be revoked while it is unused.
Seats are counted again at every profile start, so a lapsed plan does not keep five people working. When the plan drops, the live seats stay with the oldest members.
The profile quota is shared across the owner and every member. Drop a tier and the extra profiles freeze rather than vanish: they stay in the list and they do not open.
- Business, 200 profiles
- $42 / month
- Two seats over the three included
- +$6 / month
- Monthly total
- $48
- Same order paid yearly
- $38 / month, $456 / year
The browser only asks. The price is recomputed on the server at checkout.
| Free | Professional | Business | Enterprise | |
|---|---|---|---|---|
| Profiles | 2 | 10 to 100 | 200 to 1000 | 5000 and up |
| Price, per month | $0 | $6 to $25 | $42 to $139 | agreed with us |
| Team seats included, owner among them | 1 | 1 | 3 | 20 |
| Extra seat, per month | not sold | $3 | $3 | agreed with us |
| Extra profile, per month | not sold | $2 | $2 | agreed with us |
| Machines | 1 | 2 | 5 | 20 |
| API keys | – | Ya | Ya | Ya |
Five roles and what each can do
The roles are owner, admin, manager, operator and member. They are ranks, so a higher one satisfies a lower requirement.
One guard on the route resolves your role before the handler runs. Shared working resources belong to manager and above, while money, people and the log belong to admin and owner.
Editing a profile is not a role question. Only the account that created a profile can rename it or change its proxy, and to everybody else the server answers not found.
| Can do | Member, operator | Manager | Admin | Owner |
|---|---|---|---|---|
| Open a profile shared with them | Ya | Ya | Ya | Ya |
| Create profiles inside the workspace quota | Ya | Ya | Ya | Ya |
| Rename or delete a profile they created | Ya | Ya | Ya | Ya |
| Groups: create, rename, delete | – | Ya | Ya | Ya |
| Proxy library: add, edit, delete, pull with passwords | – | Ya | Ya | Ya |
| Request access from a proxy provider | – | Ya | Ya | Ya |
| Flows and schedules: create, edit, delete | – | Ya | Ya | Ya |
| Read one library proxy password | only with a profile opened to them | Ya | Ya | Ya |
| Invite, change roles, open groups | – | – | Ya | Ya |
| Plan, seats, extra profiles, payments | – | – | Ya | Ya |
| Read History and Logs | – | – | Ya | Ya |
| Unlink another person's machine | – | – | Ya | Ya |
| Cannot be removed or demoted | – | – | – | Ya |
Groups narrow what a member sees
Until you say otherwise, a member sees every profile shared with them. Give them a list of groups and the view narrows to those groups.
The limit is enforced in the list and again on a direct start by id, because a filtered list is not protection. A profile with no group at all stays hidden while a limit is set.
- 1
Make a group per client
The Groups screen. Name it the way the client is named in your invoices.
- 2
Put that client's profiles into it
A profile carries one group, and profiles outside a group are invisible to a limited member.
- 3
Invite the contractor as operator
They register first, you invite the address, they accept within seven days.
- 4
Open that one group to them
The Members screen, the Groups button next to that person. One group selected means one client visible.
- 5
Share the profiles they will open
A group narrows what they see, and a share, Share with the team in the profile menu, is what lets them launch.
The restriction stays in your workspace
The access rows are written against your workspace, not against the person. Your restriction does not travel with a contractor to their next client, and it is deleted when they leave.
One profile opens in one place
Two people opening one account from two machines is the pattern that gets accounts locked. A product built for agencies must not create it by accident, so every profile carries a claim.
A start claims the profile for three minutes and the app renews it every sixty seconds. A second machine is refused by name: who holds it, and since when.
Closing a profile releases the claim of that machine only, so your window never frees a colleague's. A machine that is switched off releases nothing, and the profile comes free on its own three minutes later.
- Response
- 409 Conflict
- error
- profile_busy
- busy.name
- Anna, MacBook Pro
- busy.since
- 2026-09-10T09:14:02Z
- busy.sameUser
- false
What the second machine receives instead of a silent failure or a silent pass.
The claim lives on the server
The log outlives the person
The vocabulary is 62 named event kinds in one file, shared by everything that writes and everything that reads.
Rows resolve to the actor's email and to the profile name, so you read words instead of ids.
Three tabs of the Logs section on the Members screen sit on the same rows: Actions with every action, Profile sessions with browser opens and closes, and IP log with logins and machine registrations carrying address and country. Reading is admin and owner only.
Who
The member's email, resolved from the user id.
What
One of 62 names, for example profile.start, team.role, proxy.secret.read.
Which profile
The profile name and its scenario, lifted out of the stored details.
From where
Address, country and machine name on logins and machine registrations.
Whose workspace
Written into the row itself, so the history survives the member being removed.
What gets flagged as suspicious
Three suspicion rules are added on top, shown in the Needs your attention block: a login from a country unused in the last thirty days, four or more profiles on one proxy, and five starts inside one minute. Our own batch launcher is excluded, because it spaces starts by three to fourteen seconds.
When someone leaves the team
Removing a person and a person leaving on their own run the same path. It is one transaction, in this order.
Profiles created after they joined move to you. Profiles they made before that were paid for by them and leave with them, with any link to your proxy library cut off.
- 1
Shares are cancelled both ways
What you opened to them, and what they opened from the profiles that leave with them.
- 2
Their claim is released
A profile they were holding does not stay busy after they are gone.
- 3
Profiles move and proxy library links are cleared
The number of profiles moved is written into the log entry.
- 4
Snapshots matching your proxy library are wiped
Address, port and login are compared, so your proxy stays out of someone's profile.
- 5
Their machines are deleted
The device seats come back to the workspace.
- 6
Invitations and group rows go
An unaccepted invitation is revoked, and your restriction does not follow the person.
What this does not do
- Roles, groups and the claim on a profile decide who touches what inside your team. They say nothing about how a site judges a profile.
- A share has no levels. There is no read-only access to a profile: the person you open it to works with everything inside it, cookies and logins included.
- Cookies do not travel with a share. The session lives in the profile folder on the machine that opened it, and moving a live session needs the sync folder (Sync sessions on the Engine screen), with the profile closed.
- The claim is a server rule. Offline, or with the server unreachable, the app still opens the profile, so two disconnected machines can open one account.
- There is no single sign-on and no company domain. Each person registers themselves, then you invite the address, and an unused invitation dies after seven days.
- One person, one workspace. A freelancer working for two agencies cannot hold both memberships, and joining you means leaving the other.
How to check
Each line names the file that does the work and the stand that keeps it honest.
- Seats are counted at the invitation, at the accept under a row lock, and at every profile start
- apps/server/src/team/team.service.ts · apps/server/src/common/workspace/workspace.service.ts · apps/server/test/team-money-seats.js · apps/server/test/quota-race-postgres.js
- A member sees only the groups you opened, in the list and on a direct start by id
- apps/server/src/profiles/profiles.service.ts · apps/server/src/team/team.service.ts · apps/server/test/group-access.js
- Two machines cannot hold one profile: 409 with the holder, conditional takeover, expiry after three minutes
- apps/server/src/profiles/profiles.service.ts (LOCK_TTL_MS) · apps/server/test/profile-lock.js
- Leaving takes back shares, the claim, machines, unused invitations and group access in one transaction
- apps/server/src/team/team.service.ts (detach) · apps/server/test/team-money-seats.js
- A log row carries the actor's email and the workspace
- apps/server/src/common/audit/audit.service.ts · apps/server/test/audit-filters.js · apps/server/test/team-money-seats.js
- A library proxy password goes to manager and above, or with the profile it is attached to
- apps/server/src/proxies/proxies.service.ts · apps/server/test/proxy-secret.js
Questions
- Can a key read more than its owner?
- No. The same role check runs on a key's request, so a member's key holding logs:read still cannot read the log.
- What if two people take the last seat?
- The accept runs under a write lock on your subscription row, so one of them gets the seat and the other a clear refusal.
- Does removing a person erase their history?
- No. Every row carries the workspace it happened in, so the log is not read through the current member list.
- What if a payment is late?
- An active subscription gets three days past its renewal date, and the app keeps working for twenty four hours without a connection to us.
- Who can unlink a machine?
- Anyone may unlink their own, and only admin and owner may unlink someone else's. An unlinked machine cannot start a profile or renew a claim.
Read next
Team, seats and roles
The same mechanics from the product side, screen by screen.
Devices and the session in the folder
How a live session moves between two machines, and what the server never sees.
Plans and seats
Tiers, the seat price, and what the checkout recomputes for you.
How we check our claims
The stands that guard every page on this site.
Put the whole agency on one subscription
Business includes three seats and five machines. Extra seats are three dollars a month each, and the checkout counts them for you.