For team members

Available toTeams Member

What your admin can see

Start here — everything else in this chapter builds on the answer. Your admin never sees your figures. What they do see is the state of your membership and a handful of yes-or-no facts about your device.

What your admin decides

Your admin writes team policies and pushes them to your device, which applies them exactly as set. A policy covers:

If more than one policy applies to you, your device combines them: every listed app and site, every listed type, every blocked file type, and the strictest text setting. And none of it can be loosened from your device — see When a setting won't budge.

What's still yours

• Your detections. Your Dashboard, Activity and detection history, all kept on your device.
• Your own reports. You can generate and export full compliance and technical reports for your own device whenever you like, and when your admin asks for one, you generate it yourself.
• The Sandbox. Try text against your device's protection; the input never leaves your device.
• Your app preferences. Appearance, language and notifications, in Settings.

Clearing detection history is the one thing that needs your admin: in Settings › Data & privacy › Delete detection history, pick the days, choose Request approval to clear this date range…, then Send this request to a Teams Admin. Your admin sees the dates and the reason you pick, never what was detected. If they approve, Locke clears exactly that range on your device and lists the clear in your reports.

What looks different in your app

1. Team policy instead of Controls. Where a Free user has Controls, your sidebar has Team policy: a read-only page of what your organization enforces on this device.

2. No Pause. The title bar has no Pause protection button on your device; see Pausing, when you're on a team.

3. A note on Reports. Your Reports page says: You can view and export your own reports. Reports and exports stay local to this device and account and are never available to team admins.

And a few smaller tells: Teams Member under your name where a Free user sees Free plan, with your organization beneath it; no My Team (that page is admin-only); and in Settings, an Organization card that reads Your team admin manages membership, policies and billing. This is read-only here.

When your admin asks for a report

Your admin can ask you to generate a report for a privacy regime and a date range. You'll see a banner at the top of your Dashboard and Reports page: Your team admin asked you for a report. It names the regime and the dates, and says what happens next: you generate it here, on this device; the report itself is never sent to your admin, only that you made it.

1. Choose Generate report on the Dashboard, and Reports opens with the requested period and regime already set. On the Reports page itself, Use requested settings does the same.
2. Save Export everything or the Compliance report as a PDF, HTML or JSON file. That completes the request; the other reports and printing don't.
3. The file stays with you. Your admin's Requests list changes to Done — that is all they learn.

A request you don't answer expires after 14 days, and your admin can cancel it before then.

When a setting won't budge

Your device is locked to your team's policy, and nothing that would weaken protection can be changed from it. Settings your team holds stay visible and say why: Your organization's policy keeps protection on for this device, so this setting is managed by your admin.

The lock comes from your team's account on Sonomos's servers, not from a file on your computer, so it can't be edited away, and neither signing out nor going offline lifts it. If a policy is blocking your work, such as a masked value breaking a task you need to do, your admin is the person who can change it. Locke support can't override your team's policy.

Pausing, when you're on a team

You can't pause protection while you're on a team. There is no Pause protection button on your device, and in Settings › Protection both the pause and When Locke can't check a request show as managed by your admin, so unchecked requests are always blocked rather than sent. Detection also keeps running if you go offline.

If you leave the team

Your admin removes you from My Team, and the app tells them what that means: They will lose access to this team. You can invite them again later. The team's lock on your device is lifted once Locke next checks your account with Sonomos, and without a Teams seat you're on Free: the same protection, with one Monthly privacy summary a month instead of full reports. Your local detection history stays where it was. Nothing about your protection gets worse — you go back to choosing your own settings in Controls.

Who to ask