Organisations

An Organisation is the top-level entity in Phase. It acts as the container for everything — all Apps, Users, Secrets, and configuration belong to an Organisation. Think of it as representing your team, company, or project group.

Structure

Every Organisation has:

• Apps — The projects and services whose secrets are managed by Phase
• Members — The users who belong to the Organisation, each with an assigned role
• Service Accounts — Optional non-human identities used for CI/CD pipelines, automation, and machine-to-machine access to secrets. See Service Accounts
• Teams — Optional groups of members and service accounts that are granted access to Apps collectively, scoped to specific Environments. Available on Pro and Enterprise plans. See Teams
• Settings — Organisation-level configuration, billing, and account recovery information

All resources in Phase are scoped to an Organisation. A user can belong to multiple Organisations, and can switch between them as needed.

Membership

When a user is invited to an Organisation, they go through a signup and key generation process that establishes their unique cryptographic identity within that Organisation. This is fundamental to how Phase's end-to-end encryption works — each member has their own set of encryption keys, and access to secrets is cryptographically granted or revoked per member — either individually, or collectively through Teams.

New members are assigned the managed "Developer" role by default, but a role can be selected during the invite process. Roles can also be changed after the member joins. Importantly, newly invited members do not have access to any Apps or Environments until explicitly granted — access must be provisioned explicitly — either per user, or via Teams.

Members do not have to be invited manually — on the Enterprise plan, they can be provisioned and deprovisioned automatically from your identity provider via SCIM.

Roles

Organisation members must have a role that determines their permissions. Phase has both managed roles and the ability to define custom roles. The key managed roles are:

For a complete breakdown of roles and permissions, see Roles.

Ownership

Each Organisation has exactly one Owner. The Owner has unrestricted access to all resources and is responsible for critical operations such as transferring ownership and managing billing.

Transferring Ownership

Ownership can be transferred to another member who holds the Admin role. This is useful when the current Owner is leaving the team or delegating responsibilities. After a transfer:

• The selected Admin becomes the new Owner
• The previous Owner is demoted to Admin and remains a member
• Both parties receive an email notification

It is critical that the new Owner has access to their account recovery kit before the transfer, as it becomes the only way to restore access to the Organisation if they forget their sudo password.

For the step-by-step process, see Transfer Ownership.

Organisation Names

Organisation names must be unique across Phase. They can contain letters and numbers. Choose a name that clearly identifies your team or company, as it will be visible to all members.

Account Recovery

Each Organisation member has an account recovery kit generated during signup. This kit contains a recovery phrase that can restore access to the member's account keys if they forget their sudo password.

• Organisation members who lose both their sudo password and recovery phrase can be removed and re-invited by an Admin
• Organisation Owners who lose both their sudo password and recovery phrase will permanently lose access — there is no recovery path. To mitigate this risk, Owners should consider transferring ownership to a trusted Admin if they are unable to secure their recovery kit

Managing Organisations

Organisations can be managed through the Phase Console, the CLI, or the API. The Console provides a visual interface for all Organisation management tasks including member invitations, role changes, ownership transfers, and settings configuration.