What Your Organization Admins Can See

You have been invited to join an organization on Squillo. Before you install anything or claim your seat, you deserve a plain answer to a fair question: what will this organization's administrators be able to see about you and your work? This page is that answer. It is written for you, not for your employer, and it is not selling anything.

One idea underlies everything below: joining an organization gives you a work account inside that organization. Your personal Squillo — your personal account, your personal vaults, your own storage — is a separate thing the organization does not acquire.

What admins can see

Who is on the team. Admins see the organization's roster: that you are a member, your name and email, and your role. They can add and remove people and change roles.
Work you put in shared company spaces. Anything you place in a shared organization vault is visible to the people with access to that vault — including its full edit history, which is append-only and never destroyed. Treat a shared vault like a shared filing cabinet with a permanent record.
What the organization spends on AI. Admins see the organization's billing and settlement events — spend at the organization level. Admins can also set limits on how much each person's AI use may spend.
The rules that apply to your work account. Admins decide which tools and models people and agents in the organization may use, where requests run, and whether auditing is required, and they can grant or revoke specific member capabilities. These policies shape your work account only: they can narrow what it allows, never rewrite your personal side.
The organization's audit trail. On plans that include audit (Enterprise), admins can read the organization's audit log of organization-level events — governance changes, billing events, and other organization-scoped activity. And if Squillo itself ever touches your organization's configuration, that write is designed to be audited and visible to the organization too — never silent.
That actions in shared spaces are yours. When you act in a shared space — or your agent acts there on your behalf — the action is cryptographically stamped as done on your behalf. Anyone who can already see the action can see it was yours. This is attribution, not surveillance: it applies only to what is already visible in that shared space.
Your seat's status. The organization is designed to see that your seat was created, that the invitation was delivered, and that you claimed it.

What admins cannot see

Your personal Squillo. Your personal account and personal vaults stay yours. Organization settings apply only to your work account, and can only narrow it — they never reach into or rewrite your personal side.
Vaults you keep private. Private vaults are deny-by-default: no grant, no access. That rule has no admin exception.
Your files, by virtue of the title. Being an admin is not a skeleton key. Access to a vault's contents is a separate permission from administering the organization — an org admin is not automatically a reader or editor of any vault.
Your screen, your keystrokes, your machine. The control surface of your Squillo runs locally on your computer — loopback-only and key-gated. There is no admin remote view of your screen, your typing, or your local activity. Device pairing and remote approvals exist, but only as explicit flows you consent to.
Your storage and your keys. Your data lives in storage you control — your Drive, your device, your peers. API keys and vault contents stay local; Squillo's design does not exfiltrate them.
Credentials shared to someone else. A credential shared to specific teammates is encrypted to exactly those people. An admin who is not a recipient cannot decrypt it, and removing a recipient is a real cryptographic re-key, not a hidden flag.
More through an agent than in person. An admin's agent can never see more than that admin personally could: an agent's authority is the intersection of what the agent is allowed and what its human is allowed. The same law protects you — your agent never exceeds your authority either.
Anything across organization lines, silently. Another organization reading anything of yours requires an explicit, auditable, read-only, revocable grant — never ambient access.

The mechanics

Squillo runs on a permissioned, append-only ledger: every grant is explicit, denial is the default, and history in shared spaces is preserved rather than quietly editable — which also means you should not put something in a shared vault expecting to erase it later. Access is deny-by-default at every layer, so what admins see is what a policy explicitly gives them, not everything the system knows. Where a flow needs more — pairing a device, approving something remotely, sharing across organizations — it happens through an explicit consent surface that you act on — nothing proceeds without you.

Questions

If anything here is unclear, or you believe something you are seeing contradicts this page, contact us at [email protected]. This page describes the platform's design and current behavior; your organization's own policies and your local law may give you additional rights and notices.