Users & Groups
Sync-in offers fine-grained control over users, their roles, and the groups they belong to.
Permissions are built at multiple levels: individual, inherited through administrative groups, or delegated in specific cases.
This architecture allows for a combination of centralized administrative control (administrative groups) and collaborative flexibility (personal groups), while ensuring security and access traceability.
👤 Users
Users are the regular members of the platform.
- ✅ Individual or inherited permissions: each user can receive permissions directly or inherit them through administrative groups.
- 🔑 Administrator role: some users may be granted administrator privileges.
- 👥 Multi-group membership: a user can belong to several groups at the same time.
User visibility is governed by group visibility rules. A user may be visible to others when they belong to a group visible to those users, or when they are not part of any group and the instance allows ungrouped users to be visible.
Users can view the groups they belong to or manage from their User Account.
👥 Guests
Guests are limited-rights users, typically used for external or temporary collaborations.
- ✅ Created by users with the guest administration permission.
- 🔒 No personal space or sharing capabilities, with limited access rights.
- 📁 Can access specific collaborative spaces or shares.
- 🌐 Have access via WebDAV.
- ⭐ Can add accessible files to their favorites.
- 🚫 Cannot become a collaborative-space manager, create shares, create share links, or manage child shares.
- 🚫 Cannot use desktop applications or synchronization.
- 👥 Can join personal groups, but not administrative groups.
- 👤 Must have at least one manager.
- ✏️ Their managers can edit their information or remove them.
Guests have no visibility over the groups they belong to. They are visible only within the collaboration contexts where they are involved, such as their managers or personal groups.
Guests cannot access personal or collaborative-space trash. They can move active content to a collaborative space's trash when their effective permissions include Delete, but only an administrator or regular user can browse or manage that trash.
🔗 Link Pseudo-users
A link pseudo-user is an isolated technical identity created automatically for a link attached to a collaborative space or a share.
- 🔒 Cannot authenticate through the normal login flow; access is established through the link.
- 🎯 Can access only the space or share attached to the link, while the link is active and its access conditions remain valid.
- 📁 Can browse, download, comment on, and modify accessible content according to the link's Add, Edit, and Delete permissions.
- 🗑️ Cannot access personal or collaborative-space trash.
- 🚫 Has no personal space, personal trash, favorites, WebDAV access, desktop application access, or synchronization.
- 🚫 Cannot anchor files, create shares or child shares, manage shares, or become a collaborative-space manager.
🧑🏫 Administrative Groups
Administrative groups are used to structure permissions within the organization.
They can represent teams, entities, departments, or roles in the company.
- 🔐 Managed only by administrators.
- ⚙️ Can hold permissions on applications.
- 👀 Can be configured to hide their members or make them visible to everyone.
- 🧱 Flexible structure: administrative groups can be organized either flat or nested
(a group can contain other groups), allowing an accurate reflection of your organization's hierarchy or roles.
In a nested group structure, permissions are not automatically passed down to child groups.
Each group manages its own permissions independently.
Managers
Administrative group managers are designated by administrators:
- ➕ Can add or remove members from the group.
- 🚫 Cannot appoint other managers, nor remove their own management rights.
- 👁️ Do not have any access or visibility over potential child groups.
👨👩👧👦 Personal Groups
Personal groups are designed to support collaboration without impacting application-level permissions.
Used to organize collaborative spaces or shares, they are strictly private and managed by end users.
- ✅ Creation restricted to users with the personal group administration permission.
- 🧩 No permissions can be granted via these groups.
- 🚪 Members can leave the group at any time.
- 👤 Each group must have at least one manager.
- 🧱 Flat structure: groups are independent, with no support for nesting or subgroups.
Managers
Personal group managers are designated by users with the personal group administration permission.
They can perform the following actions:
- ➕ Add users or guests.
- 📝 Rename the group, manage members and managers.
- ❌ Delete the group, if necessary.