Team server

A team server lets several people and computers work on the same profiles. You host it yourself, so the team’s data stays with you. MZBase does not run team servers and never sees what is on them.

What it does

• Members and devices: accounts with two-factor sign-in, device approval, sessions, remote sign-out and wipe, IP allow lists.
• Sharing: groups and access levels per folder and per profile; a shared vault for logins and 2FA codes.
• Locks: a profile opens on one device at a time. The device holding it sends a heartbeat every 90 seconds; a lock without one expires after 5 minutes. Admins can take over.
• Sync: when a profile closes, the app uploads the changed parts as a compressed, encrypted bundle straight to your storage bucket; the next device downloads and decrypts it. The team server only signs the upload and download links.
• Activity log: sign-ins, profile opens and edits, vault reveals, automation and Trash, with device and IP.
• Team policies: for example whether members may keep local-only profiles.
• Web dashboard for members and admins, served by the same server.

Where to host it

	Cloudflare	Docker
Good for	Small teams; often within the free tier	Larger teams, your own VPS
Database	D1	SQLite file
Profile bundles	R2	Any S3-compatible bucket (R2, S3, MinIO, …)
Locks and realtime	Durable Object	In the server process

Both answer GET /healthz, serve the API under /api/v1 and the dashboard on every other path.

Create one from the app

Creating a team server needs a trial or a license (not the Free plan). In the app, choose Create a team server on the welcome screen, or start it later from Settings → Account.

Cloudflare

Give the app a Cloudflare API token with the permissions it lists. It creates the Worker, the D1 database, the R2 bucket and the Durable Object on your account, registers you as the owner and activates this device.

Docker on your Linux server

The app shows one command to paste into an SSH session on your server. The command:

1. downloads the install script and checks its SHA-256;
2. redeems a single-use install code (valid one hour) for the team server image; your license key is never on the command line;
3. writes the configuration and generates the server’s secrets on the server itself;
4. starts the server with Docker Compose behind Caddy, waits until it is healthy and checks the bucket.

Then go back to the app and press Continue: it registers you as the owner and activates the device. Put the printed .env file in your backups.

Joining a team

Members use Join a team on the welcome screen (or Settings → Account) with an invite link or the server address, then sign in. Joining needs no plan of its own: the team’s license counts, and each computer takes one of its seats.

If a session ends (expired, or the device was revoked), the app shows who and which server, and offers to sign in again or continue with local profiles. Team profiles are hidden until you sign in again; they stay on the device.

Seats and licenses

The team server checks seats with MZBase’s license service when a device activates and refreshes a signed license token regularly. A license can split its seats into sub-licenses, one key per office or customer, from the console.

Backups and upgrades

• Cloudflare: D1 has point-in-time restore; R2 keeps the bundles.
• Docker: back up the .env file, the SQLite database and the bucket; the install script has an --upgrade mode that fetches the newest image with the server’s key.