> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mauvely.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspaces

> A shared, end-to-end encrypted drive for a team, with its own storage allowance and its own chat — and an honest account of what removing someone can and cannot undo.

A workspace is a drive several people share. It has its own storage allowance, separate from
anyone's personal one, and a chat that only its members can read.

<Info>
  Workspaces are part of **Pro** and **Max**. A standalone Compose or Snap subscription does not
  include them — those buy a desktop app licence, not Cloud storage.
</Info>

## How it works underneath

Worth knowing, because it explains most of the behaviour further down.

A workspace is a **folder** — a root folder with no parent. Its key is wrapped separately for
every member, using the same mechanism that shares a folder with a named person. Adding someone
is one key wrapped to them; removing them deletes that wrapped copy.

Everything else follows from that:

<CardGroup cols={2}>
  <Card title="Files behave normally" icon="folder">
    Folders, uploads, previews, version history and the trash all work exactly as they do in your
    personal drive, because they *are* the same thing.
  </Card>

  <Card title="Mauvely still cannot read it" icon="lock">
    The workspace key never reaches the server. Members hold it; we hold wrapped copies we cannot
    open.
  </Card>
</CardGroup>

## Creating one

**Workspaces → New workspace**, and give it a name. The name is encrypted like everything else —
it is stored under the workspace's own key, so it is not something Mauvely can read either.

You become its owner. The workspace gets its own allowance straight away: **1 TB** on Pro,
**2 TB** on Max.

## Members

Only an owner can invite or remove people. An editor who could invite would be able to widen
access they were given, which is not something their role is meant to carry.

| Role            | Can                                                                 |
| --------------- | ------------------------------------------------------------------- |
| **Owner**       | Everything, including inviting, removing and deleting the workspace |
| **Can edit**    | Add, change and delete files; take part in chat                     |
| **Can comment** | Read files; take part in chat                                       |
| **Can view**    | Read files and chat; cannot post                                    |

### Inviting someone without a vault

You can invite an address that has never opened Cloud. The invitation is recorded and they show as
**waiting for their vault** — nothing is readable to them yet, because there is no public key to
wrap the workspace key to.

Once they set one up, the wrap happens automatically the next time an owner unlocks their vault in
a browser. Only a member's browser can do it; nobody at Mauvely can do it for you.

### Removing someone

<Warning>
  **Removing a member stops them reaching the workspace. It cannot un-know a key they already
  had.**

  Their wrapped copy of the key is deleted and the server stops serving them, so they lose access
  to everything from that moment — including anything added later. But if they downloaded a file
  while they were a member, that copy is theirs and no key management can reach it.

  This is the same honesty that applies to revoking any share. If someone leaving is a real
  concern, treat what they already had as theirs.
</Warning>

## Storage

A workspace is charged for its own files, whoever uploads them. Upload a 2 GB video into a
workspace and it comes out of the workspace's allowance, not yours — otherwise one member's
personal quota would rise and fall with the team's activity, which nobody could plan around.

The workspace panel shows its usage. Your own sidebar figure stays personal.

## Chat

Every workspace has one conversation, beside its files.

Messages are encrypted under a key derived from the workspace's own key, so **exactly the people
who can read the files can read the messages** — that falls out of the key structure rather than
being a permission we check.

* **`@` to mention someone.** Start typing and pick from the member list.
* **Enter sends, Shift+Enter starts a new line.**
* **Edit or delete your own messages.** An owner can also delete anyone's, for moderation.
* A **viewer** can read the chat but not post.

New messages appear within a few seconds. The app polls rather than holding a live connection;
in a background tab it backs right off, so a workspace left open is not a reason your laptop
never idles.

<Note>
  **What the server can see about chat.** Message bodies are ciphertext. But *who was mentioned*
  is stored in the clear, along with when each message was sent and by whom — that is what makes
  an unread badge and a "you were mentioned" pill work without decrypting anything.

  It is recorded here rather than left to be discovered. See [Security](/cloud/security) for the
  full list of what is and is not hidden.
</Note>

## Deleting a workspace

Only an owner can, and it is immediate and total: every file in it is destroyed for everyone.
There is no trash for a workspace — a half-deleted one would still appear in every member's
sidebar with no way to explain what it was.

Individual files inside a workspace go to the trash normally.

## What is not built yet

<Card title="Coming later" icon="clock">
  * **Domain-based auto-join** — everyone with a `@company.com` address joining automatically.
  * **Per-workspace billing.** A workspace's allowance comes from its creator's plan today; it has
    no separate subscription.
  * **Live chat.** Messages arrive by polling, not push.
  * **Re-keying on removal**, which is the only thing that would change the warning above.
</Card>