Companies and members in Awthy Hub

A Hub account is a named company workspace. The company name appears in the Hub header and account selector. Licences, installs, clients, member scope, and pending invitations belong to a specific company. When you switch companies, Hub rotates the session and shows only the records for the company you chose.

Every new signup creates one company workspace, and the first verified user becomes its owner. A separate Personal account type does not exist. The owner is prompted to set the company name before inviting members or linking sites.

Why a company is named

Awthy supports teams that own more than one store or want a colleague to help manage installs. Naming the company keeps the Hub account utility clear and prevents mixing sites across different teams. The name you enter is shown to every member of the company in Hub.

Roles

A company has four roles. A member's company role and any client scope are separate choices:

Owner manages the company, members, site links, recovery, and automation. The first verified user becomes the owner.
Staff can link sites, run scans and automation, and perform recovery work, but cannot manage company members.
Member can view the company, link sites, and use scans and automation, but cannot perform recovery work or manage company members.
Read only can view the company and its permitted records, without site-linking or mutation access.

When inviting or updating a member, choose either account-wide access or selected, non-empty clients. Hub keeps the selected scope explicit rather than silently broadening a member's access. The invited role and scope are stored before activation and remain in force after the colleague confirms the link; a resend cannot silently change them.

Invite a member

Only an owner can invite members. To invite a member:

Open the company settings for the company that owns the store or stores the new member will help manage.
Enter the colleague's email address and send the invitation.
Hub emails a short Hub sign-in link. The link works in any browser and expires after 15 minutes.
The colleague opens the link and confirms through the existing Hub confirmation form. This is the same secure, one-time proof used to sign in to Hub normally — there is no separate invitation code to manage.
If the email already belongs to another company, Hub asks the colleague to choose which company to sign into. Picking the invited company completes the invitation. Otherwise the invitation stays pending.

The link opens the same scanner-safe confirmation form as a normal Hub sign-in. The link never reveals account existence to anyone who has the email address but is not the invitee. If the link expires before it is used, the owner must send a new invitation from the company settings. Cancelled invitations cannot be activated. Removing a member revokes that member's sessions and assignments without deleting their other company memberships.

If the company is unconfirmed

The first time someone signs in to a fresh Hub account, Hub creates a company workspace with the temporary name “My company”. The owner must set a real company name before inviting members, switching companies, choosing a license, or creating a claim code. Until then the only available actions are signing out and setting the company name.

Switch between companies

One email can belong to more than one company. When that happens, Hub shows the company selector so you can pick the company you intend to work in. To switch later, open the account menu and choose a different company. Hub rotates the session, signs out the previous selection, and shows the licenses, installs, and reports for the new company. Switching never carries claim codes, install secrets, or session cookies between companies.

Link a WordPress install

Owners and eligible members can link a WordPress install to a company. A member with selected-client scope can link only an active install assigned to one of those clients. The link and relink flow is the same one-time claim-code flow already used in Hub:

Sign in to Hub and switch into the company that should own the new site.
Choose the license that should cover the site, open Licenses & claims, and select the site's full HTTPS URL.
Create a fresh claim code. The claim code expires quickly and works once.
In WordPress, open Awthy Security -> Settings -> Hub connection and paste the claim code.

The WordPress install is then linked to the active company. The site appears in Hub under that company's installs until the activation is reclaimed, replaced, or transferred.

Clients and exact-site delegation

Clients are subordinate groups inside a company. Owners can create, rename, assign members to, and archive a client. Archiving preserves its sites, backups, and history but removes it from active scope choices; it is not deletion. Clients are different from independently signed-up Hub companies.

If another company needs one of your sites, grant that exact site from the owning company. Choose one fixed profile: Viewer, Operator, or Recovery operator. The recipient company owner assigns its own active members within that profile's ceiling. Viewer covers site status, reports, and backup metadata; Operator adds scans and automation; Recovery operator adds recovery and download operations. Reducing a ceiling applies immediately; increasing it waits for recipient-owner acceptance. Delegation does not transfer ownership or a licence. Expiry, cancellation, revocation, relinquishment, or member removal stops future delegated requests; it does not delete the site's history. Other grants and recipient companies remain independent.

The owning company remains responsible for its own member and client scope. A recipient cannot use a delegated site to discover other sites, clients, or company members.

Members and last-owner protection

Every company must keep at least one active owner. Owners cannot be removed or changed to a non-owner role while they are the only owner of the company. If you need to hand a company to a colleague, promote them to owner first and only then change your own role.

If access is not what you expected

Check the active company, member role, and selected clients first. For a delegated site, check the grant profile, expiry, and recipient-member assignment as well.

Example: give a colleague Read only access to one client when they only need to review reports. Give a separate company's operator an exact-site grant when they must work on one site without seeing your other clients.

Awthy support operators are separate from customer company members. Operator access is bounded, role-checked, and audited; support does not impersonate a customer owner. Ask support to correct a company or membership record when a normal owner action cannot do so.