Team and sync

Workspaces, teams and Cloud Sync

How workspaces and roles work, inviting teammates, how synced sessions are encrypted, and what Cloud Sync moves between your computers.

Guide · 2 min read

Workspaces and roles

A workspace is the shared container for a team's profiles, and each member carries a role that sets what they can do inside it. Workspaces, members and roles come from your ArticleOps organisation, so that is where they are managed. Keep separate clients in separate workspaces so access follows the work.

Switch workspace

The card at the bottom of the sidebar names the workspace this window shows, with how many profiles it holds. Choose it to list every workspace you belong to, and pick one; with more than eight there is a search box. When the sidebar is collapsed the card is the small up-and-down button at the bottom.

Invite by email

Invite teammates to a workspace by email. The invitation ties the workspace to that person's account, and their role decides what they see once they join.

How synced sessions are encrypted

Cloud Sync encrypts a profile's session on your computer before it is uploaded, with a key that belongs to the workspace, and decrypts it on the computer that opens the profile. PowerOps creates that key itself. The ArticleOps service keeps a copy of it and gives it to a computer when an account that belongs to the workspace signs in there, so there is no key to copy between machines. It also means Cloud Sync is not end-to-end encryption: the service that stores your synced sessions holds the key as well, so they are protected by your ArticleOps account and by that service, not by a secret that only you hold. On each computer, the passwords PowerOps keeps for you live in the operating system's credential store.

What Cloud Sync moves

Cloud Sync, which is on unless an owner or admin has switched it off, captures cookies, Local Storage and IndexedDB when a profile closes, and encrypts the capture on your machine before it is uploaded. The profile itself crosses too, with its name, group, tags, device identity and proxy, so it appears on your other computers ready to open. Those details are not encrypted with the workspace key, and they cross whether Cloud Sync is on or off. The proxy password and any saved account sign-in details are encrypted with it.

Use Cloud Sync between computers, step by step

The single-holder lease

One device holds a synced profile at a time. Opening the profile takes the lease, and the lease releases when the profile closes and its state is captured. The lease is what stops two machines from writing over the same session.