Roles and permissions

1. Team roles

Every member of a team holds one of three roles. The role is set when you are invited and can be changed by the owner.

Roles govern team-wide actions such as inviting people or exporting. What you can do inside a particular shared folder is governed by your folder grant, described next.

2. Folder grants

Inside a shared folder, each member holds one of four grants: viewer, editor, admin or owner. Grants are set per folder by a folder admin. A subfolder can narrow a grant but not widen it. Team owners and admins hold at least admin on every shared folder.

3. Team permissions

These are the team-wide permissions, what each one allows, and whether each role holds it by default.

The owner always holds every permission and can change the admin and member defaults in Admin console → Settings → Permissions. The server checks the matrix on every call, so a permission that is off for your role cannot be reached by a client that ignores the setting. Billing is owner-only and cannot be granted to another role.

4. Team security policy

Two switches in Admin console → Settings apply to the whole team. Only the owner can change them.

Two-step verification for admins

When this is on, inviting people, removing them, changing roles, transferring ownership and changing seats all need a sign-in that used an authenticator code. The owner must turn on two-step verification for their own account first (Account details → Security) and sign in again with a code before switching it on, so nobody is locked out.

AI parsing for team scans

When this is off, scans run in the team scope use Sigbot's built-in parser only, and nothing from a connected inbox leaves the platform. A team-scoped scan uses AI only when both this switch and the scanning member's own setting (Account details → Privacy) are on. Our Privacy Policy describes what is sent when it is on.

5. Scan rules

Scan rules are a list of email addresses and domains that a scan treats differently. A member whose role has Manage scan rules keeps the team's list from the Admin console; it applies to every scan run in the team scope.

• Exclude — messages from the address, or the domain and its subdomains, are dropped before classification, so the sender never reaches the team's contacts or review queue.
• Internal — marks the team's own domains, so colleagues who email you are not filed as external contacts.
• Also remove existing matches — when you add a rule you can also purge every existing record that matches it, together with its change history and review-queue entries. The rule then blocks the address from being filed again. A team rule acts on the team's records only; a member's personal contacts stay theirs.

Personal accounts have the same list under Import Emails → Scan rules; it applies to your own scans.

6. Private contacts

Any member can mark one of their contacts private. In shared folders, teammates then see a row labelled "Hidden contact" with no name, email address or other details, so they know a record exists and can ask about it. A member whose role has View private contacts sees the full record, as does the member who owns it.

7. Where this is enforced

Every team action goes through Sigbot's servers, which check the caller's role, folder grant, permission set and the team's security policy before acting. Team actions such as invitations, role changes, exports and permission changes are recorded in the team's audit log. The controls on this page form part of the measures described in our Security Overview and Data Processing Addendum.

8. Contact

Questions about roles and permissions: support@sigbot.co. Security questions: security@sigbot.co.