Free vs Teams

The two plans

The three roles

Teams has two roles inside it, so there are three states the app can be in. The bottom-left corner of the window always tells you which one you're in, under your name; on a team, your organization's name sits beneath it.

One thing to know before you go looking: the Profile card in Settings › Account writes your plan as Free plan, Teams — member or Teams — admin, while the sidebar and the rest of this guide say Teams Member and Teams Admin. Same role, two labels, nothing to read into it. On a team, Plan & billing shows the subscription and seats to the admin; a member sees that their team admin manages plan and billing.

What each role can do

The admin's own Controls are read-only too — always, not only when a policy is pushed to them. An admin changes protection by editing team policies in My Team › Policies, and the admin's own device follows the policies pushed to all members or to them. (Controls lists the few AI-service choices an admin still makes on their own device.)

How a team policy applies

On Teams, protection settings come from team policies the admin writes in My Team › Policies. A policy sets four things:

• Required AI apps and sites — the AI apps and websites Locke must screen.
• Always-masked detection types — values of these types are always masked; a team policy never sends a type in the clear.
• Text strictness — Relaxed, Standard or Strict. Image and file strictness is coming later.
• Blocked file types — readable formats are screened or blocked. Images and audio, which Locke can't check yet, are sent unscreened unless the policy sets them to Block.

A device under several policies combines them: it screens every listed app and site, masks every listed type, blocks every listed file type, and uses the strictest text setting.

And a member's device is locked to the result. From the member's own computer account, nothing that would weaken protection can be changed: they have a read-only Team policy page in place of Controls, no Pause, no way to let unchecked requests through, and no way to clear their detection history without the admin's approval. On a locked device Locke also keeps screening every AI app and site, even one a policy leaves out. The lock comes from the team's account on Sonomos's servers, not from a file on the computer, so editing files, signing out or going offline doesn't lift it. What the member sees is covered in For team members.

What Free shows, and what it locks

Team management — My Team, team policies, report requests — simply isn't in a Free app. Reports are different: every report beyond the Monthly privacy summary is visible but locked, with an Upgrade to Teams prompt, and Activity says that CSV and JSON export are part of Teams.

On a member's device, settings the team holds stay visible rather than disappearing, with the reason next to them. Hiding them would just make the app look broken.

Moving between plans

Where to go next

• Running a team: My Team (admins).
• On a team someone else runs: For team members.
• On your own: protection is unchanged for you — carry on with Controls.
• What Locke doesn't do yet, on any plan: Known limitations.