# Team members, roles and sign-in security

> Invite teammates, understand owner, admin and member roles, and protect your login with two-factor authentication or a passkey.

Updated 2026-11-10 · Account and billing · https://kalmananalytics.com/support/team-and-security/

## Roles

Each workspace has its own members, and each member has one role in it:

- **Owner:** everything, including signing the BAA, changing roles, removing members and deleting the workspace. A workspace has one owner, and that role can't be changed or invited.
- **Admin:** renames the workspace, invites admins and members, cancels invitations, and manages integrations and billing.
- **Member:** uses the app and can invite other members.

## Invite someone

1. Go to **Settings → Workspaces** and click **Edit workspace** on the workspace.
2. Under **Members**, click **Invite member**.
3. Enter their **Email address** and pick a **Role**. You can't give a role higher than your own.
4. Send the invitation.

Invitations expire after 3 days. You'll find them under **Pending invitations**, where you can **Resend** one or, as an owner or admin, cancel it.

## Change or remove a member

Only the owner can do this. In **Members**, click a person's role to pick a new one, or use **Remove member**. To leave a workspace you don't own, go to **Settings → Workspaces** and click **Leave workspace**.

## Turn on two-factor authentication

1. Go to **Settings → Security**.
2. Under **Two-factor authentication**, click **Enable 2FA**.
3. Scan the QR code or enter the setup key in your authenticator app, then click **Continue**.
4. Enter the 6-digit code from the app.

Then click **View recovery codes** and keep them in a password manager. Each code works once if you lose your phone. **Regenerate codes** replaces them.

## Add a passkey

A passkey lets you sign in with your device's fingerprint, face or PIN instead of a password.

1. Go to **Settings → Security → Passkeys**.
2. Click **Add passkey**, give it a **Passkey name** and click **Register passkey**.
3. On the sign-in page, choose **Sign in with a passkey**.

You can remove a passkey from the same section. If the browser doesn't support passkeys, the page says so.

Still stuck? Log in and open a request: https://app.kalmananalytics.com/support