How it works
Your team, step by step
Their own link, not yours
Revoking a seat revokes that link only. Nobody has to change anything else.
Roles that mean something
Reading, approving, publishing and billing are separate. The person who moderates the queue does not have to be the person with the card.
Two seats on Starter, more on Pro
Pro adds seats at $5 a month each, as a line on the subscription, and the same page takes one off again.
Who has which testimonial
Anyone who may approve can give a testimonial waiting in Pending to the owner, an administrator or an editor — one at a time or a selection — or take it off them. Each card in the queue says who has it, "Assigned to me" shows a person their own, and the testimonial's history records who gave it to whom and when. A viewer, and a seat the plan no longer carries, cannot be given one.
A second person before anything is published
On Pro, the owner can require approval by two people on the same page. An editor's Approve — and an administrator's, and the owner's own — becomes a proposal, and an administrator or the owner who did not propose it signs. The history of each testimonial says who proposed and who signed, by the names you gave the seats.
Hand a project to somebody else
The owner types the new owner's address, and we email that person a link that works once, for 72 hours; the owner never sees it, and can cancel it or send it again until it is accepted. Opening it shows what comes with the project — its seats, webhook endpoints, store connections, feeds and channel — before they choose. When they accept, the project is theirs on their own plan, the old dashboard link opens nothing, and each of the two gets one email saying so.
Billing, on the payment provider's own page
Once you have paid, Manage billing on the same page opens the billing page of the company that takes your payments, Paddle or Stripe, for your account, already signed in: change the card you pay with, download receipts and invoices, or cancel. Each press asks for a new page, and its address is not kept.
When a payment does not go through
A failed payment deletes nothing, and your plan stays as it is while the payment provider tries the card again; Manage billing is where you change the card. For a subscription billed by Paddle, the message about it links to /billing/update, where a secure window from Paddle opens to update the card, with no need to log in.
Safe by design
The rule that makes it safe to have
Clear boundaries
What it will not do
Every capability page ends with this list. It is the part that says what you are actually buying.
- A seat cannot delete the project.
- A seat cannot add or remove a paid extra.
- A seat's link never becomes the owner's link.
- A seat cannot open billing, and is not told the account's customer id at the payment provider.
- It will not keep, email or log the address of the payment provider's billing page.
- A checkout tells the payment provider the project's public address and the plan, never your dashboard link.
- No plan, extra or pack counts because of a click: each is read back from the payment provider's own record of your subscription, and a refunded or disputed pack stops counting when the provider reports it.
- The page for a failed payment never asks for or stores a card itself: the card goes into Paddle's own window.
- Paddle's script loads only on that page and, while Paddle takes new subscriptions, on the checkout; that page passes it nothing about you. No script of Stripe's loads on this site at all.
- Under approval by two people, an editor cannot sign, nobody can sign their own proposal, and only the owner can switch the rule off.
- Giving a testimonial to somebody is a record of who has it, not a lock: it publishes nothing, and anybody else who may approve can still decide it. Who has it is shown only in your dashboard and your export's history, never on a wall, the widget, the API or the record page.
- Only the owner can change the deadlines, the overdue email and the hold on automatic approvals.
- Handing a project over never moves the subscription: it stays with the person who pays for it, with its extras and packs, and the project goes onto the new owner's plan.
- Handing a project over never emails anybody a dashboard link, and only the owner's own link can start it.
- Handing a project over revokes its API keys and connected assistants and stops its client share links, because they belong to the previous owner's own integrations; webhook endpoints, store connections and seats stay until the new owner removes them.
- A project on a plan given rather than bought cannot be handed over.
Where it lives in the code: lib/seats.ts · lib/access.ts · lib/triage.ts · app/api/triage/assign/route.ts · lib/approval-rules.ts · app/api/approval/route.ts · lib/addons.ts · app/api/addons/route.ts · lib/billing-portal-rules.ts · lib/billing-portal.ts · app/api/billing/portal/route.ts · lib/stripe-rules.ts · lib/stripe.ts · lib/stripe-billing.ts · lib/stripe-addons.ts · app/api/stripe/webhook/route.ts · app/api/billing/checkout/route.ts · app/billing/update/page.tsx · components/PaymentUpdatePaddle.tsx · app/dashboard/[token]/team/page.tsx · lib/transfer-rules.ts · lib/transfer.ts · app/api/transfer/route.ts · app/api/transfer/receive/route.ts · components/TransferProject.tsx · components/TransferReceive.tsx · scripts/transfer.mjs
Questions
Asked about this
From Help, where every answer is written from the product as it runs.
Can you read my testimonials?
An operator can open a dashboard, and the privacy page says so in plain words: we can, we do it to answer a request you made or a fault you reported, and not otherwise.
Is my customer's email address ever public?
No. An author's email address is in no public answer, from any endpoint, on any plan.
Can I give somebody access without giving them my link?
Yes — a seat has its own link and its own permissions, and revoking it revokes only that one. A seat cannot delete the project or add a paid extra to your subscription.
Does the widget track my visitors?
It counts views, plays and clicks per widget so you can tell whether anybody is reading them. There is no visitor profile and no cross-site identifier. Your page's visitors are not our product.
This is running now
Open a project and use it. Nothing on this page is a roadmap.