2026-09-10
Your team shares one balance, one set of keys, and one way out
An account can have more than one person on it now: one credit balance, one set of API keys, and a page that says in plain words what a teammate can and cannot see. Removing somebody settles their keys and their scheduled monitors in the same breath — including when they leave by accepting an invitation somewhere else.
- An account can have more than one person on it. Everything about the product assumed one login owned one balance, so a team either shared a password or bought a second account and reconciled two bills. An account now holds the credit balance and the API keys, and the people on it — an owner, admins and members — spend the one balance and use the one set of keys. The monthly free grant is per account, not per head, which is what it always said on the pricing page.
- The team page says what is shared and what is not, because not everything is. Per-resource ownership deliberately did not move: your bulk runs, your lookup history and your suppression lists stay yours and stay private from your colleagues. A customer who read "shared account" as "shared everything" would be wrong about three things they care about, so the page lists them rather than leaving it to be discovered. The ledger does answer "where did my credits go" account-wide, with a spend column per member.
- Inviting is a signed link that consumes nothing when it is opened. Corporate mail scanners fetch every link in an inbound message, and a one-step accept would be burned by a robot before the human ever clicked it. Only the token's hash is stored, so a database dump hands over no live invitation, and withdrawing one kills the link immediately. Nothing in the flow says whether an address already has an account here.
- Before you accept, the page prices it: the balance you are leaving behind, the keys that change hands, and how many scheduled monitors move with you. Accepting is a move, not a merge — the account you own stays exactly as it is, dormant, holding its balance and its whole history, and it is what you come back to if you leave the team.
- Leaving settles what you leave behind, whichever of the three ways out you take. Being removed, leaving, and accepting an invitation somewhere else are three different doors and only two of them settled anything. Your secret keys on a team you have left are deleted, because a secret key is the account's credential and somebody who has gone must not walk away with one that works. Your publishable keys are not: those are embedded in the customer's own site and revoking one takes their widget down, so they are repointed at the owner instead.
- Your scheduled monitors come with you. They were stamped with whoever was paying at the time they were made and nothing ever revisited that, so a list belonging to somebody who had left went on running hourly and billing the team they left — for good, while they could still add rows to it. They now move to whichever account you are on, so the bill follows the person who controls the spend. Nothing pauses and nothing is deleted.
- A daily check that can actually be cleared. There is a command that asserts the whole thing — every person on exactly one account, every row that spends money pointing at a live one, every monitor billing an account its owner is actually on — and it runs at 03:35 every night. It had one hole worth naming: it did not know about the dormant account somebody leaves behind when they join a team, so the first accepted invitation would have failed it permanently. An alarm that can never be cleared is worse than no alarm.
markdown version: /changelog/2026-09-10-accounts-your-team-shares-one-balance.md · atom feed: /changelog.atom