Everybody who uses the vault gets their own seat.
A seat is two things at once. It lets that person sign in to the vault website, and it lets them connect their own AI to the vault. Same seat, same permissions, both ways in.
Every seat has a role. There are three, and the differences are simple.
Owner. You. Everything. Read, write, correct, trash, restore, connect mailboxes, add people, see the activity log, see the money side. If you have a business partner who genuinely runs the place with you, they can be an owner too. Otherwise keep it to one.
Editor. Your staff. They can read everything, search everything, use email drafting, and write into the working folders. They cannot change your canonical notes. If a manager types "the deposit is now 40%", it does not silently become true for the whole business.
Reader. Read and search, nothing else. No writes at all. Good for a bookkeeper, a casual, a contractor, or anybody who needs to look things up but has no business changing what the company knows.
This is the bit worth being precise about, because it is the whole reason you can hand a seat to a casual without worrying.
An editor can:
staff/ and dropped/, the working foldersAn editor cannot:
policies/, prices, business/, suppliers/, or any other canonical noteSo the flow is: staff notice things, staff write them into the working folders, and you promote the ones worth keeping into the real notes. Nothing enters the company's memory without passing you.
That is deliberate. A business memory that anybody can quietly rewrite is not a memory, it is a rumour.
Every staff session ends with the AI writing a short journal entry. What was done, what was learned, what was decided, what went well or badly.
It is one entry per person per day and the AI writes it, so nobody has to remember to.
Once a week, as the owner, say:
"Go through the journal from the last week and promote anything durable into proper notes or rules."
Ten minutes. You get a list of what your team actually learned that week, and the good bits become permanent.
This is the real pitch, and it is worth sitting with for a second.
Think about what walks out the door when a good staff member resigns. Not the tasks, you can rehire for tasks. What walks out is the two years of small knowledge. Which supplier actually answers the phone. Why you stopped doing Sunday deliveries. The exact way this one difficult customer likes to be handled. Where the spare key is. The workaround for the thing that has been broken since 2024.
None of that is written down anywhere, because nobody ever writes it down. It lives in one person's head and it leaves with them, and the next person spends six months rediscovering it, badly.
The vault is where it stops leaking. Their journal entries and their working notes are already in the business. You promoted the durable ones as you went. When the resignation comes, the handover has already happened, quietly, over two years.
The new person's first week starts with an AI that knows how the place works.
Seats come with your plan. There are two kinds, counted separately.
AI seats are owners and editors. Anybody who can write or use email.
Reader seats are read only.
Your Admin page shows both counts at the top, like "3/3 AI seats" and "4/10 reader seats". When you are out, that is the point to talk to us rather than sharing a login.
Never share a seat between two people. Two people on one key means the activity log cannot tell you who did what, and that is the log's only job.
On the vault website:
The key is shown once. It is not stored anywhere and it cannot be shown again. Copy it there and then, and put it somewhere sensible. A password manager is the right spot.
If it gets lost, that is fine and it happens. Go back to Admin, press New key on that person, and hand over the new one. Their old key stops working the moment you do.
When somebody leaves, press Deactivate on their row. Their access dies immediately, on the website and on whatever AI they had connected. Everything they wrote stays in the business, which is the entire point.