# Workspace and team

> How workspaces and projects are organised, what each role can do, how agencies handle clients, where connections live, and how sign-in security works.

**In short:** A workspace holds your projects, members, provider keys and billing. Each project is one site in one market. Each member has one of five roles, and SerpDad checks the role on the server for every action.

## Workspaces

A workspace is your team's space in SerpDad. It holds:

- Projects
- Members and their roles
- Provider keys and spend controls
- The plan subscription
- The search data bought with its keys

SerpDad creates a workspace for you when you sign up. You can belong to several workspaces, with a different role in each. Open **Workspace > All workspaces** to switch, create a new workspace, or leave one that someone else owns.

The workspace name shows in the switcher, invitations and emails. The workspace's URL slug is fixed when it is created.

### Data bought with your keys

Workspace settings show how many search results and volumes are stored, the oldest fetch date, and how many the last run reused. That data is read only by this workspace's projects. Other workspaces never read it, and neither do SerpDad's free tools. Runs reuse a stored result for free for 30 days.

## Projects

A project is one site and one market inside a workspace.

| Field | Rule |
|---|---|
| Name | Required |
| Site address | https. Needed to route keywords to pages your site already has. |
| Market | United States, English, desktop. Fixed when the project is created. |

There is no project limit. To plan for a separate set of keywords, create another project. Deleting a project asks you to type its name and shows what will go. Provider keys and other projects are not touched.

## Roles

| Role | Summary |
|---|---|
| Owner | Can do everything, including billing and deleting the workspace. There is one Owner. |
| Admin | Manages provider keys, members, runs, briefs and sign-offs. Cannot manage billing or delete the workspace. |
| Manager | Approves runs, settles reviews, generates briefs, invites members and signs articles. Cannot manage provider keys or billing. |
| Editor | Edits and verifies briefs, drafts and signs articles, and stages signed drafts. Cannot approve runs, change jobs, invite members, or manage keys or billing. |
| Writer | Edits, verifies and exports briefs, and drafts articles. Cannot approve runs, regenerate briefs or sign articles. |

### What each role can do

| Action | Owner | Admin | Manager | Editor | Writer |
|---|---|---|---|---|---|
| View projects, plans, receipts and briefs | Yes | Yes | Yes | Yes | Yes |
| Create projects and import keywords | Yes | Yes | Yes | No | No |
| Approve a run at or below the approval line | Yes | Yes | Yes | No | No |
| Approve a run above the approval line | Yes | Yes | No | No | No |
| Answer review calls about the plan | Yes | Yes | Yes | No | No |
| Answer review calls about a signed article | Yes | Yes | Yes | Yes | No |
| Move keywords, pin owners, change focus, merge, junk | Yes | Yes | Yes | No | No |
| Connect or disconnect Search Console | Yes | Yes | Yes | No | No |
| Generate and rebuild briefs | Yes | Yes | Yes | No | No |
| Edit, verify and export briefs | Yes | Yes | Yes | Yes | Yes |
| Draft articles | Yes | Yes | Yes | Yes | Yes |
| Sign articles (never your own last edit) | Yes | Yes | Yes | Yes | No |
| Stage signed drafts to draft targets | Yes | Yes | Yes | Yes | Yes |
| Add and edit authors and voice samples | Yes | Yes | Yes | Yes | No |
| Create, edit and run workflows; set up jobs | Yes | Yes | Yes | No | No |
| Grant standing approvals | Yes | Yes | No | No | No |
| Manage provider keys, spend cap and approval line | Yes | Yes | No | No | No |
| Change brief spend controls and voice settings | Yes | Yes | No | No | No |
| Invite members (up to your own role) | Yes | Yes | Yes | No | No |
| Change roles and remove members | Yes | Yes | No | No | No |
| Rename the workspace | Yes | Yes | No | No | No |
| Subscribe, cancel and manage billing | Yes | No | No | No | No |
| Delete the workspace | Yes | No | No | No | No |

A role that cannot open a page sees a page that names the role and who can change it.

## Invite your team

1. Open **Workspace > Workspace**.
2. Enter the person's email and pick a role. You can give a role up to your own.
3. Send the invitation.

Invitations expire after 3 days. Resending sends the email again and starts a new 3 days. There is no seat limit. The invited person signs in or creates an account, then joins with one click.

When you remove a member who saved a provider key, SerpDad warns you that they still know the key. The Owner gets an email to rotate it at the provider.

## Agencies and clients

In the Jobs hub, each project in your workspace is a client. The **Clients** page shows each client's job runs, open tasks and spend this month. See [Jobs and workflows](../workflows/).

You can also give each client its own workspace. Each workspace has its own keys, members and billing, and is billed as its own plan. See [Billing](../billing/).

## Connections

| Connection | Where | Scope |
|---|---|---|
| Provider keys | Workspace > Provider keys | Workspace |
| Slack, Linear, Asana, Trello, webhooks, Google Sheets | Workspace > Connections | Workspace |
| Search Console | Workspace > Search Console | Project |
| WordPress, Webflow, Shopify, Google Docs | Workspace > Draft targets | Project |

## Security

| Feature | How it works |
|---|---|
| Passwords | At least 12 characters, checked against known data breaches |
| Two-factor authentication | A 6-digit code from an authenticator app, or a recovery code. You get 8 recovery codes. Each works once. |
| Passkeys | Sign in without a password. Add and remove passkeys in **Security**, with added and last-used dates. |
| Continue with Google | Sign up or sign in with a Google-verified email. Two-factor authentication still applies. |
| Linking Google | An existing password account links to Google only after you sign in with the password once |
| Confirming sensitive actions | Changing keys, two-factor settings or passkeys asks you to confirm your password, a passkey, or Google |
| Isolation | Every page checks that its data belongs to your workspace. Another workspace's data returns "This page does not exist". |

You can delete your account from **Profile**. It is blocked while you are the only owner of a workspace that has other members.

## Related

- [Billing](../billing/)
- [Provider keys](../provider-keys/)
- [Jobs and workflows](../workflows/)
- [Quickstart](../quickstart/)