Groups
Permission requirements
- Vault Files and Directories
- View their files and files shared with them (needed to download)
- View the history of their files (sharing, project tags, deletion)
- Create files (needed to upload)
- Get the keys of their files and files shared with them (needed to download)
- Download the content of files they can access
- View their directories and their groups' directories
- Create directories (also needs “Add items to directories”)
- Delete directories (also needs “Remove items from directories”)
- Groups
- View groups they are a member of
- Get the keys of groups they are a member of (needed to open and share group files)
- Create groups
- Rename groups they own and give ownership to another member
- Add users to groups they are a member of, if the group allows it
- Change other members' group permissions in groups they are a member of
- Remove users from groups they are a member of, if the group allows it
- Delete groups they own
- Projects
- View projects they are a member of
- View the members of projects they are a member of
- Tag what they own with a project they are active in
A group is a named set of tiCrypt users who share files. Every group has one owner, any number of members, and its own folder in the Vault. A file added to the group's folder is shared with every member of the group, now and in the future, without being shared with each of them one by one.
Why groups exist
Sharing with people one at a time does not scale. A lab or study team shares the same files with the same people over and over. Sharing each file with each person means every new file needs every name, and every new team member needs every file. A group turns that into one decision: put the file in the group's folder, and everyone in the group has it.
Membership controls access, so access follows the team. Adding someone to a group gives them every file in its folder; removing them takes away the files they had only through the group. You change the membership once instead of re-sharing or unsharing every file.
A group is separate from a project. A project decides who is allowed to open data with a given classification. A group decides who the files are shared with. A group can be tagged with a project, and then its members still need an active membership in that project to open the group's files. That is why tiCrypt warns you when you add a member who has none: they will be in the group, but the project keeps them out of its files until they join it.
When to use a group
- You regularly share files with the same set of people, such as a research team or a lab.
- You want new files to reach everyone on the team as soon as they are added.
- You want to manage access in one place: adding a member grants access to the group's files, and removing one revokes it.
Share a file directly with a user instead when only one person needs it, or when the share should expire or carry restrictions. Files in a group's folder are shared permanently and without restrictions. See Share.
Before you begin
- You need the Create groups permission to create a group. Without it, the Create group button does not appear.
- To tag a group with a project, you must be an active member of that project.
- Members can be added only to a group whose key you can get, which needs the Get the keys of groups they are a member of permission.
Where groups appear
Groups have their own Groups section in the left panel of the Vault, below the Vault section. It lists the folder of each group you are a member of, whatever your role in it, and the group's project tag when it has one. Click a group's folder to show its files in the file list, and right-click it for the group's menu.
The Create group button sits in the Groups header when you can create groups.
When the section has nothing to list, it says why:
- "You are not part of any groups.": you are in no group. The text reads "Create a new group, or ask to be added to an existing group.", or "Ask to be added to an existing group." when you cannot create groups.
- "You can't view group folders.": your account lacks View their directories and their groups' directories. The text reads "Your groups' folders need permission to view folders. Ask an administrator for it." Create group still works, because groups can still be shared with.
Admins and Super-admins can see every group in the system from Management. See View Groups from Management.
The group menu
Right-clicking a group's folder in the Groups section shows the folder's own actions and the group's actions. The following table describes the group's actions and when each one is offered.
| Action | Offered when |
|---|---|
| Edit | You can do at least one thing that Edit changes: rename the group, change its project, add or remove members, or change their restrictions. |
| Rename | You have Rename groups they own and give ownership to another member, and you own the group, have the Admin role, or are a Sub-admin who manages the group's project. |
| Change project | You can tag what you own with a project, and you own the group or your restrictions in it do not include Cannot manage group. |
| Change owner | You have Rename groups they own and give ownership to another member, you own the group or have the Admin role, and the group has another member who can become owner. |
| Leave group | You are a member but not the owner, and you have Remove users from groups they are a member of, if the group allows it. |
| Delete | You have Delete groups they own, and you own the group, have the Admin role, or are a Sub-admin who manages the group's project. |
The same menu appears in Management for Admins and Super-admins. See Groups in Management.
Create a group
- Go to the Vault icon in the top left panel.
- In the Groups section of the left panel, click Create group.
- Optionally, click No project at the top left of the window and pick the project to tag the group with.
- Optionally, click the Rename group button next to the group's name and type a name in Group name. Leave it empty to name the group after its members.
- Click Add members, tick the users to add, and click Continue with n.
- Optionally, set each member's Group restrictions. See Group restrictions.
- Click Create.
tiCrypt shows "Created group group-name", the group's folder appears in the
Groups section, and you are its owner. The members you picked are added in the
background, and the task tray shows "Add n users to group-name".
The window is laid out like the Share dialog. At the top it shows the group's project, its name, and "n members", counting you. The Add members list shows every user you can see except you and the people already listed, and Filter by name or email… narrows it. Users without an active membership in the group's project read "No active membership in this group's project" in the list.
The group name
The name is optional. A group saved without a name is named after its members by their first names, for example "Bob, Cy", and the name follows the membership as people join and leave. You appear in it as "Ann (you)" only when you are the group's only member. While the name is empty, the window reads "n members · named after its members".
A typed name follows these rules:
- Length: at most 80 characters. Message: "May not exceed 80 characters".
- Characters: none of
/\|":*?<>{}or a NUL character. Message:May not contain any of /\|":*?<>{} or NUL. - Unique: no other group of yours has the same name. Message: "Conflicts with another group".
Members without project membership
When the group has a project, every listed member who has no active membership in that project is marked "No active membership in this group's project", and a notice above the list reads, for example, "2 members have no active membership in this group's project. They can be members but cannot open the group's files until they join the project." You can still add them. Ask a manager of the project to add them to it so they can open the files.
You may be asked to enter your password when you create a group, if your private key is no longer held in memory.
Edit a group
Edit opens the same window as Create group, filled in with the group. It is where you see the group's members and change them.
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Edit.
- Make your changes: add members, remove members, change restrictions, or rename the group.
- Click Save.
A new name is saved first ("Group renamed to new-name", or "The group is now named after
its members" when you cleared it). Members you added, removed or restricted are then changed in the
background, and each change shows as a task in the task tray.
Each member row shows the member's name and email, a crown on the owner's row, their Group restrictions, and a Remove from group button. A group with no one else in it reads "This group has no other members yet." What you can change depends on your rights in the group: controls you cannot use are disabled, and Add members appears only when you can add members.
Clicking the project at the top left of the Edit window opens Change project, which applies at once rather than on Save. See Change the Project of a Group. The owner is changed from the group's menu, not from this window.
Group restrictions
Each member can do everything in the group unless you restrict them, the same way a file share starts with full access. The Group restrictions list next to a member offers two restrictions, and an empty list reads Full access. The following table describes them and the group permissions each one removes.
| Restriction | What the member cannot do | Group permissions it removes |
|---|---|---|
| Cannot manage files | Add files to the group's folders, create folders, or remove files and folders. | Add Directory Entries, Create Directories, Remove Directory Entries |
| Cannot manage group | Add or remove members, change their permissions, or change the group's project. | Add Members, Remove Members, Change Permissions, Modify Project Tag |
Every member can open the group's files, whatever their restrictions. The owner can do everything in the group whatever their permissions, so the owner's restrictions cannot be changed. A restriction shows as set when the member lacks any one of the permissions it covers, which can happen for members whose permissions were set one by one before version 2.18.2.
You can change restrictions when you have Change other members' group permissions in groups they are a member of, and you own the group, have the Admin role, or are not restricted with Cannot manage group. Without that right, members you add join with the default group permissions.
A member counts as a manager of the group, for example in the Managers column in Management, when they can add members, that is, when they are not restricted with Cannot manage group.
Add members to a group
- Open the group's Edit window from its menu in the Groups section.
- Click Add members.
- Tick the users to add. Use Filter by name or email… to find them.
- Click Continue with n.
- Optionally, set the new members' Group restrictions.
- Click Save.
The task tray shows "Add n users to group-name". Each new member gets the group's
key and can open its files, if the group's project allows them.
Add members appears when you have Add users to groups they are a member of, if the group allows it, and you own the group or are not restricted with Cannot manage group. An Admin role alone does not give it, because adding a member requires your copy of the group's key.
You cannot add members to a project-tagged group unless you are an active member of the group's project.
Add a user to a group from their user panel
You can also start from the user. In a user's panel, the Groups in common with you tab (Groups in your own profile) has a Add to group button, and Admins find Add to group in the user's menu under Management > Users. The pop-up is titled "Add user to your group":
- Pick the group in the group field. It lists only the groups where you can add members and that the user is not in yet ("Only showing groups in which you have permission to invite users").
- Optionally, set Restrictions. Leave it at Full access to give the user every group permission.
- Click Add to group.
If the user has no active membership in the group's project, a notice says they will be added but cannot open the group's files until they join the project. If you cannot change member permissions in that group, the pop-up reads "You do not have permission to change member permissions within the selected group." and the user joins with the default group permissions.
Remove a member from a group
- Open the group's Edit window from its menu in the Groups section.
- Click Remove from group on the member's row.
- Click Save.
The member is removed in the background. They lose access to files shared with them only through the group, and can no longer see the group's folder or interact with the group.
Remove from group is disabled on the owner's row and on your own row; leave a group from its menu instead. It works when you have Remove users from groups they are a member of, if the group allows it, and you own the group, have the Admin role, or are not restricted with Cannot manage group. Users you added in the same window and have not saved yet can always be taken off the list.
Rename a group
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Rename.
- In the Rename group pop-up, enter the new name in New Name.
- Click Rename.
tiCrypt shows "Group renamed to new-group-name", and the group's folder takes the new name.
New Name follows the rules in The group name, except that it cannot be empty ("You must enter a name"). Keeping the current name shows "Same name as before", and a failure shows "Failed to rename group". You can also rename a group, or clear its name so it is named after its members, from Edit.
Change the project of a group
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Change project.
- In the Change project tag for group pop-up, select the project.
- Click Classify (the button reads Declassify when you select a parent project or No project (unlocked)).
The task tray shows "Classify group-name" or "Declassify group-name", and the
group's folder shows the new project tag.
- You must be an active member of both the group's current project and the new project. Without the override option described below, you can only move a group to a subproject of its current project (Classify) or to a parent project or no project (Declassify).
- Multiple groups can share the same project tag.
- Group members who are not active members of the project cannot access the tagged group's files.
To remove the project, select No project (unlocked) and click Declassify.
Force a project change
Users who may override project rules see an extra option in the Change project pop-up:
- Tick Use my permission to override rules, re-tag resources with any visible project, regardless of current project relations.
- Select the project to tag the group with.
- Click Force change with admin privilege.
The task tray shows "Set project for group-name".
Change the owner of a group
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Change owner.
- In the Change the owner of group pop-up, pick the member in New owner.
- Click Change owner.
- In the Transfer ownership of group to member? confirmation, click Yes.
tiCrypt shows "Transferred ownership to user-name", and the crown moves to the new owner's
row in Edit.
The previous owner loses all their permissions within the group, not only ownership. They can no longer delete the group, but they can leave it. The new owner gets full permissions and can delete the group, but cannot leave it unless they transfer ownership again.
New owner lists the group's other members, except deleted users. When an Admin changes the owner of someone else's group, the confirmation names the current owner as the one who loses their permissions.
Share files with a group
There are two ways to share Vault files with a group:
- Put them in the group's folder. Drag files from the file list onto the group's folder in the Groups section, or upload into it. A drag between your folders and a group's folder copies the files, after the Confirm file copying dialog. Files in the group's folder are shared permanently with every member, with no expiration or restrictions. Dropping needs Add Directory Entries in the group, that is, no Cannot manage files restriction. See Drag and drop.
- Share them with the group. Use Manage Share, or Share with group when several files are selected, to share files with the group like with a user, with an expiration and restrictions. The files stay in your folders. See Share.
Download group content
bulk-action
- Go to the Vault icon in the top left panel.
- In the Groups section, click the group's folder.
- Select the group file(s) or directory(ies) you wish to download.
- Click Download in the top center panel.
- In the prompt, preview the file and directory structure.
- Select the destination of your download.
- Click Download.
Downloading a group's contents removes the group's encryption. It is your responsibility to secure the files.
- You may be asked to enter your password when changing the download destination.
- You can set a default download destination for groups by clicking Set as default after making your selection.
Compute disk usage of a group
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Compute disk usage.
The size appears in parentheses after the group's folder name. See Compute Disk Usage.
Delete a group
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Delete.
- In the pop-up, click Yes to confirm.
tiCrypt shows "Deleted group-name", and the group's folder disappears from every member's
Groups section.
The pop-up is titled "Delete group?" and reads "Deleting a group is irreversible. Members will lose access to shared files unless they have otherwise been granted access. Additionally, the group file system will be destroyed. Are you sure you want to delete group?" If deleting fails, the message "Failed to delete group" appears.
The group owner can delete a group, and so can Admins, Super-admins and Sub-admins who manage the group's project. Other members can only leave the group.
Leave a group
- Go to the Vault icon in the top left panel.
- In the Groups section, right-click the group's folder.
- Select Leave group.
- In the pop-up, click Yes to confirm.
tiCrypt shows "You left group-name", and the group's folder disappears from your
Groups section.
The pop-up is titled "Leave group?" and reads "Someone who has permission within the group will need to re-invite you for you to access resources shared with the group (but not you) again." If leaving fails, the message "Failed to leave group" appears.
The owner cannot leave a group; change the owner first, or delete the group. Leave group also needs the account permission Remove users from groups they are a member of, if the group allows it.
View groups from Management
Admins and Super-admins can list every group in the system, including groups they are not in, under Management > Users > Groups. Selecting one group there offers the same group menu as the Vault. See Groups in Management.