Team Setup

Team Setup

Second Brain can be a private store for one person or a shared brain for a small team. This page covers turning on team mode, adding people, and what changes when you do.

If you are the only person using your brain, you do not need to enable team mode. The Team tab remains available to the owner so there is always a place to invite the first member; layer controls stay out of the memory screens until team mode is actually on.

How team mode works

A team brain has two layers:

• Personal — your own memories. Nobody else on the team can see them, search them, or reach them through any AI client. This is where everything lands by default.
• Company — the shared layer. Everyone on the team can find these.

Sharing moves a memory from personal to shared. There is never a second copy, and you can move it back. A company memory can only be edited or deleted by its author, or by an admin.

Team mode turns on the moment your brain has more than one person in it, and the dashboard shows the team features from that point on. There is nothing to redeploy.

There is also a Team mode switch on the Team tab, for when you want to look around before inviting anyone. Turning it on gives you the shared layer and the sharing controls while you are still alone, so you can set your defaults and see how it behaves first.

The switch and your actual team cannot disagree. While anyone else is on the team it stays on and is locked, with a note saying so — turning it off would hide the sharing controls from you while colleagues were still using the shared layer. Once you are the only person left, it unlocks and you can turn it off again, which returns the brain to exactly how a solo brain behaves.

Before you start

You need:

• Your Worker deployed and reachable, and your owner password (the AUTH_TOKEN you set at install).
• A way to send each person their sign-in token privately — a password manager, a DM, anything that is not a shared channel.

Setting up a new brain as a team brain

1. Install normally. Follow the Setup Guide — desktop app, one-click deploy, or manual. There is no separate "team" install.
2. Open the dashboard and sign in as the owner.
3. Name the team. Go to the Team tab and rename it from the default. The name appears in every member's app and in the activity log, so it is worth doing before anyone joins. If you want to explore the shared layer before inviting anyone, turn on Team mode on the same tab.
4. Add your first member — see Adding a member below. Team mode turns on as soon as this succeeds.

Turning an existing brain into a team brain

Your memories are safe. The upgrade is additive: no memory is moved between layers, deleted, or made visible to anyone else.

1. Upgrade the Worker to a version that supports teams, using How to Upgrade. Nothing else changes yet.
2. Open the dashboard once as the owner. On the first request after the upgrade the Worker migrates its own schema — it creates the team tables, gives you an owner identity, and files every existing memory into your personal layer. Your password keeps working unchanged and you do not have to sign in again.
3. Check the migration. All your memories should still be present and search should work as usual. The Team tab is now available to the owner, but the capture, recall, and memory screens remain in solo mode until you enable team mode or add someone.
4. Name the team, then add your first member below.

What the upgrade does to your existing memories

• Every existing memory and link is filed into your personal layer. Nothing becomes shared. Nothing is deleted.
• Your existing password becomes the owner account. No new credential to store.
• Semantic search keeps working over everything you already had.
• The migration runs once, automatically, on the first request. There is no command to run and no maintenance window.

Adding a member

1. In the dashboard, open the Team tab and choose Add member.
2. Enter their name, optionally an email, and pick a role:
   • Member — reads and writes their own personal layer, reads the shared layer, and can share their own memories into it.
   • Admin — everything a member can do, plus managing people and seeing the team's activity log.
3. Copy the sign-in token immediately. It is shown once and stored only as a hash — nobody, including you, can retrieve it afterwards. If you lose it, use Reset token to issue a new one.
4. Send it to them with Copy invite message, which fills in your Worker URL and instructions and copies it to your clipboard, or Email invite (shown once you enter an email for them), which opens the same message as a draft in your own mail client. Second Brain does not send anything itself either way: you copy the message and paste it, or you open the draft and hit send.

They sign in by entering the Worker URL and that token — in the desktop app, or in the dashboard directly. They get their own personal layer immediately.

What a new member can and cannot see

A member joining an existing brain sees none of anyone's personal history. Their personal layer starts empty, but they can see memories that were already deliberately placed in the company layer.

	Owner / admin	Member
Their own personal memories	yes	yes
Your personal memories	no	no
The shared layer	yes	yes
Who is on the team	yes, with details	names and roles only
Other people's private memory counts	admins only	no
Add, suspend or remove people	admins only	no
The team activity log	admins only	no

Nobody can read anyone else's personal layer — that includes you. Being an admin lets you manage people, not read their memories.

Sharing a memory

Open any memory and choose to share it. It moves to the shared layer and everyone on the team can find it. You can move it back to personal at any time.

Only the memory's author — or an admin — can edit or delete it once it is shared. Everyone else can read it and link to memories in the same layer.

Where new memories land

Each person has a capture default, set on the Team tab:

• Personal — everything they capture stays private.
• Company — everything they capture goes to the team.
• Auto — follows the organization default the admin has set.

The composer shows which one applies before you capture, so "Auto" is never ambiguous.

Managing people

All of this is on the Team tab, and admins only:

• Reset token — issues a new sign-in token and invalidates the old one. Use this if someone loses theirs or you suspect it has leaked.
• Suspend — blocks access without removing the person. Their memories stay put. Reversible.
• Remove — revokes access permanently and deletes that person's personal memories. Anything they shared with the team stays, still credited to them. This cannot be undone.

Removed and suspended people keep their names on anything they shared, so the team's history stays readable.

You cannot remove your own account, and you cannot remove the last active admin — the brain would have nobody who could manage it.

Roles

• Admin — manage people, see the activity log, edit or delete anything in the shared layer, set the organization-wide capture default.
• Member — everything else: their own personal layer, the shared layer, and their own capture default.

The owner (whoever holds the original AUTH_TOKEN) is always an admin.

Frequently asked

Can I go back to a solo brain? Yes. Remove everyone else — that revokes their access and deletes their personal memories, while anything they shared stays, still credited to them. With only you left, the brain behaves as a solo brain again, and you can also switch Team mode off explicitly on the Team tab.

Turning it off hides the layer controls; it does not delete anything. Memories already in the shared layer stay exactly where they are and you can still read them — they simply stop being labeled as shared. Turn it back on and they are labeled again.

Will my colleagues see my existing memories? No. Everything you had before becomes your personal layer, and personal is private to you. Only memories you explicitly share become visible.

Does each person need a Cloudflare account? No. Only whoever deploys and updates the Worker needs Cloudflare access. Everyone else just needs the Worker URL and their token.

Can a member update the Worker? No. Updating the Worker redeploys it to Cloudflare, which only the owner's account can do. Members are told when the brain is behind rather than being offered a button that cannot work for them.

What happens if two people share the same thing? Both memories exist. Duplicate detection works within a layer, so near-identical shared memories are flagged the same way duplicates always are.

Is there a limit on team size? Nothing enforced in the product. The practical limit is your Cloudflare plan's free-tier budgets — a handful of people is comfortable.

Using the CLI and other clients with layers

The brain CLI (0.1.0, the only version published) does not yet have a --workspace flag on remember, recall, or list, and brain list does not mark which rows are shared. Every CLI capture uses your own capture default, the same as an unqualified capture from any other client. To target a specific layer today, use an MCP client or the REST API's workspace parameter instead (see below).

AI clients connected over MCP work the same way: the remember, recall, list_recent and share tools all accept a workspace argument, so you can tell an assistant to save something to the team layer directly. Over the REST API the same parameter is available on POST /capture, GET /list, GET /recall, and GET /graph — see the API Reference.

See also

• Setup Guide — installing in the first place
• How to Upgrade — getting the latest Worker deployed
• Web UI — the dashboard, including the Team tab
• API Reference — the endpoints behind all of this