Roles, invites and sessions

#Profile page

Clicking your name at the bottom of the left menu opens the account menu, and Profile there takes you to your profile page (/profile). The page opens inside the app, so the left menu, the bell and the chat stay where they are. The same menu holds Tool access, the Help Center, Keyboard shortcuts and Sign out. On a phone it sits behind your avatar in the top bar, and behind the avatar at the bottom when the left menu is collapsed. Everything here is independent of the workspace, so it looks the same whichever workspace you open it from.

The page has five tabs.

Tab	What it holds
Account	Avatar, display name, username, email and the list of workspaces you belong to
Security	Password change and active sessions
Preferences	Interface language, theme (light / dark / system) and notification preferences
Tool access	Setup steps for tools such as Claude Code, Cursor and VS Code, and the access tokens of all your workspaces (shown if you belong to at least one workspace, more in Collaboration)
Memory	Your personal memory notes (shown if you belong to at least one workspace)

The fields on these tabs work like this.

Field	Notes
Avatar	Upload a photo (PNG, JPG, WebP or GIF, 5 MB at most) or draw your own avatar. If you do neither, a face generated from your name is used.
Draw	The Draw button under the avatar opens the generator. You pick hair and head, hair colour (it only applies to some hairstyles), expression, beard, glasses, skin, clothing and background colour one by one. Every hair, expression, beard and glasses option is shown as a small face, so you simply click the picture. You can also roll the dice for a random face. Below the large preview you see the small sizes your avatar has in the app. When you save a face you drew, the photo you uploaded earlier is removed, because your avatar is always your most recent choice.
Display name	The name shown in comments, assignments and the team list
Username	Your @user.<name> mention identity. It can be changed, and it accepts lowercase letters, digits, hyphen and underscore.
Email	Cannot be changed, because it is your account's identity and your sign-in key. Its verification status is shown here.
Language	Turkish or English. It is saved to your account, so you see the same language whichever device you sign in from. Your notifications and the emails sent to you are written in it too. On first launch your browser's language is picked.
Theme	Light, dark or system. With System the app follows your device, so when the device switches to dark, the app switches with it immediately. The choice is stored per device.
Password	You need your current password to change it.
Active sessions	The list of devices, and you can end any one you do not recognise.
My workspaces	Shows your memberships and your role in each.

#Two notes about avatars

• Changing an avatar cannot be undone. The old image is deleted permanently and the file does not wait in the trash. A profile picture is not a document you will want back.
• Avatars do not appear on the Files screen. They are profile images rather than documents, so they cannot be mentioned with @file and do not count against your file quota.

If you change your username, old @user.<old-name> mentions no longer point to you. Changing it rarely is a good idea.

#Identity and sessions

• Sign-up. This uses an email address and a password. Passwords are protected with bcrypt, and email verification is required.
• Sign in with Google or GitHub. If it is configured on your server, "Continue with …" buttons appear on the sign-in and sign-up screens. If you already have an account with the same email address, a second one is not created, and the provider account is linked to your existing account. An email the provider has verified counts as verified in Orbi too, so you do not wait for another verification message. An account opened this way has no password, and you use the password reset flow if you want to set one.
• Session. A short-lived access token works together with a long-lived refresh token. A separate session is kept for each device.
• Devices do not knock each other out. The long-lived key changes at every refresh and the old one stops working. If an old key is presented again, only that device's session is closed, and the sessions on your other devices are untouched. Three things close the whole account, and all three are deliberate decisions. They are changing your password, resetting your password, and Close all sessions on the Profile → Security tab.
• Active sessions. The same tab lists your devices and lets you end any session you want. When you lose your phone, you can drop that device without changing your password.
• Password reset. This is requested from the "Forgot your password?" link on the sign-in screen, and the link that arrives by email is valid for 1 hour. A reset closes every session, and this is deliberate, because a password reset is usually asked for in order to set the account's security up again.

Your account can also be left without a workspace, so you may simply be a user waiting for an invite.

How many free workspaces. One person can open at most one free workspace. What counts is the workspaces you opened. The ones you joined by invite do not count, however many of them there are. Workspaces on a paid plan do not count either, so if you move your existing workspace to a paid plan you can open a free one again. Workspaces in the trash still count, so instead of opening a new one in place of a deleted workspace, you can restore the old one from the trash.

If a workspace on a paid plan goes back to free while you already have a free workspace, the returning workspace stops receiving its monthly free credits. The workspace is not closed. Its content stays, your team keeps using it, and any credits you purchased remain valid. To get the credits back, either close your other free workspace or pick a paid plan for this one, and both work. We email you when it happens, and the Settings › Plan page explains the reason.

#Exporting the workspace

Admins can download the entire workspace as a single zip archive from the Settings › Data tab. The archive carries projects, tasks (comments, checklists, history), collections (fields, records, views), files (including the ones in the trash), agents, flows, calendar events, chats, memory notes, policies and the audit trail. The manifest.json inside the archive says which version it came from and what it contains. The data sits in readable JSON lines, with the files beside it.

The archive carries closed spaces too, even when the admin who downloads it is not a member of them. That is why every export is written to the Audit tab for each closed space it covers.

Some things stay out of the archive. LLM API keys, connection credentials (connectors, MCP), API tokens, invite links, billing and usage records and the search index are left out. This is deliberate, so that the archive is not a transfer of permissions, and they are set up again when you restore it later. The CSV/Excel export of collections is separate and is the practical route for everyday use (Collections). This archive is the full copy you take before closing a workspace, or in order to move it.

Restoring. The Import from archive button in the workspace list builds a new workspace from an archive, with you as its admin. An existing workspace is never overwritten. Members are matched by email address, anyone without an account on this installation is not added, and the report says so. Tasks that were queued or running are not restarted, they arrive as "to do". The address of incoming webhook triggers is regenerated, and you take the new address from the flow canvas. Outgoing connections (webhooks) arrive turned off with a new signing secret; you give the secret to the receiver and turn the connection on (Changing the secret). The text of files is extracted again and the search index fills by itself. If the archive came from a newer Orbi than the installation, the import is refused and the installation has to be updated first. For now, archives of up to 200 MB can be imported.

The new workspace starts on the free plan. If your archive is larger than that plan's limits, its contents are not trimmed. The workspace is built as it was and starts above the limit. You keep seeing and using everything, but you cannot add a new member, space or flow until you are back under the limit. Upgrading the plan or removing what is spare lifts the restriction. File space is the one exception. If the files in the archive add up to more than the free plan's file space, the import is refused up front, because those files take up room from the moment they land.

#Leaving, deleting and closing your account

These three are hard to undo. Each goes through a confirmation step, and in all of them the same rule holds, because a workspace is never left without an admin.

• Leaving a workspace. You leave from the Hard to undo section on the Settings › Data tab. Your comments and your tasks stay in the workspace and only your membership ends, so to come back you have to be invited again. You cannot leave if you are the last admin, and you have to make another member an admin first. You also cannot leave a workspace where you are the only member, and the right move there is to delete it.
• Deleting a workspace. Only admins can delete one. The founder has no special privilege, all admins are equal. To confirm, you type the workspace's name exactly. A deleted workspace waits in the trash for 30 days, and during that time any admin can restore it from Deleted workspaces in the workspace list. Once the time is up, projects, tasks, collections, files, agents and the audit trail are deleted permanently. Billing records stay with the payment provider, as legal retention requires.
• Deleting your account. This is done from the Delete account section at the bottom of the Profile › Security page, and you type your email address to confirm. Your name, email, avatar, password and linked Google/GitHub accounts are deleted, and your sessions and API tokens are closed. The comments you wrote and the task history stay, signed "Deleted user", so your team's history is not broken. Workspaces where you are the only member go to the trash with your account. If there are workspaces with other members where you are the only admin, you are asked to hand over the admin role or delete those workspaces before deleting your account.

#Inviting teammates

The Settings → Team screen manages people, which means invites, roles and removal. AI teammates have their own page. Agents in the left menu is the single place to edit them, covering job description, model, connections, avatar and deletion. The Team screen only tells you how many agents you have and links there.

The number sits there because of seat counting, since adding an agent also spends one of the team member slots in your plan (Plans).

There are two ways to invite a person.

Method	How it works	When to use it
Personal invite	Sent to a specific email address. Clicking the invite link counts that email as verified.	People whose name and address you know
Shareable link	Anyone with the link joins with the role you pick. You set an expiry and a usage limit when you create it.	An open invite to drop into a Slack channel, or a short-lived viewing link for a client

#Shareable links

The New link button under Settings → Team → Shareable invite link creates a link. You choose three things.

Choice	Options	Note
Role	Admin, Member, Viewer	Everyone who joins through the link gets this role. Pick Viewer for people who only need to watch.
Expiry	No expiry, 1 day, 7 days, 30 days	7 days is preselected. The link closes on its own when it expires.
Usage limit	Unlimited, 1, 5, 10, 25 people	The link closes when the limit is reached. If two people try for the last seat at the same time, only one gets in.

Several links can exist side by side, for example a permanent Member link for the team and a 7-day, 5-person Viewer link for a client. The list shows each link's role, how long it stays valid, how many times it was used and who created it. An expired or exhausted link stays in the list with a badge, and you can delete it. Deleting a link does not affect the membership of people who already joined through it.

Someone who opens a closed link sees why, "expired" or "usage limit reached", so they can ask you for a new one. You still cannot follow who the link reaches. For a sensitive workspace, prefer the personal invite, or give the link a short expiry and a small limit.

If the email cannot be sent, the invite is not lost. The invite email goes out in the background, and if the server cannot deliver it for the moment (because the email settings are wrong, for example), delivery is retried automatically at growing intervals. The dialog also always gives you the invite link. If you do not want to wait, copy it and pass it on yourself, because the link works exactly as if it had arrived by email. The invite also stays in the pending invites list, where the Copy button gives you the link again later.

#Join requests

The invite has a mirror image. Someone who sees a page your team shared can send you a request with the Join this team button at the top of that page. The request needs an Orbi account (if they do not have one, they create it there and verify their email), so you always know who the request came from.

When a request arrives, admins get a notification and an email. Under Settings → Team → Join requests you see the person's name, their email and which page they came from, then pick a role and press Approve or Decline. The role picker starts at Viewer, because the person came in from a view-only link, and you can make them a Member or an Admin instead. Approval is subject to the same seat count as an invite, so if your plan has no room, you have to make room first. The decision reaches the person as a notification and an email.

One person has a single pending request per workspace at a time, and can send at most five requests a day. If you do not want the button shown at all, turn off the switch on the Settings → Sharing tab, and pending requests are not deleted.

#Roles (RBAC)

Workspace roles are per workspace, so the same user can be an Admin in one workspace and a Viewer in another. A person works in spaces with this role too; they can also get a different role (manager, member, viewer) in one space only (Spaces).

Role	Permissions
Admin	Space/member/MCP/billing management, adding a collection to the menu as a screen, every write operation
Member	Writing tasks/comments/storage, connecting personal MCP
Viewer	Read only

Every server endpoint is protected by role. An operation you are not allowed to perform does not appear in the interface and is refused even if it is called directly.

#What only Admins can do

• Opening spaces (the person who opens one becomes its manager; the space's manager opens boards and channels)
• Seeing the Audit tab of the Inbox
• Inviting members and changing roles
• Adding a workspace-wide MCP connection (every member adds their own personal connection)
• Adding a collection to the menu as a permanent app screen
• Plan and subscription management

#Title and description

Every member can have a title and a short description specific to this workspace, just like agents. The title is a single line such as "Product designer". The description says what the person does, what they decide on and how they should be addressed, up to 280 characters.

These two fields are not only for people. Agents see the team list on every run, and when they write to someone, for example Orbi in the morning briefing or when it reminds you of a waiting card, they read that person's description: the designer gets user impact instead of technical detail, the engineer gets short and concrete. When you say "assign this to the designer", the agent finds the right person by title.

You write the title and description on the Settings → Team screen. An Admin edits everyone's, each member edits their own row. You can write the title when you send an invite; it moves to the membership when the person joins. Someone who joins through the shareable link starts empty.

Where it shows:

• In the team list, under the name.
• In the list that opens when you type @, under the name. If you do not remember the name, type the title; "design" finds the designer.
• In the person card that opens when you click a person chip in a comment or a description. The card shows the name, title, role and description. Clicking an agent chip opens the same card for the agent, with buttons to the agent page and to a chat.

#Agents and visibility

All agents are open to the whole workspace, so there are no personal or hidden agents. The reason is simple, because anyone should be able to assign any agent to a task. Editing an agent affects everyone who uses it.

#Data isolation

Every workspace's data stays inside it. A member of one workspace cannot see the task, file or collection of a workspace they do not belong to, not even if they know its identifier. Details: Security and plans.