Team & Permissions # Right Access, Right People Give designers, contractors, and finance the access they actually need — and nothing more. Three permission layers, Teams for larger orgs, and a "most permissive wins" rule that makes overlapping access predictable. [Start Free Trial](/signup?cta=Start+Free+Trial) Unlimited users on Pro, Business & Enterprise Account, project & server-level scopes Teams on Business & Enterprise Last updated on 18th May 2026 Team · Deploy Engineers Account Manage agentsOn Manage billingOff Projects All projects2 excluded Update configurationOn Servers ProductionNo deploy StagingCan deploy DeployHQ permissions are layered: every grant lives at one of three levels — account, project, or server. Permissions stack from broad to narrow, and when multiple grants overlap, the most permissive wins. That's it — no role matrix to memorise. ## Three Permission Layers Each layer answers a different question. Grant only what each role actually needs. Account ### What can they touch across the account? - **Account administrator** — full access, including billing - **Manage users** — invite, edit, remove - **Manage billing** — payment methods, invoices, plan changes - **Manage agents** — network agents for firewalled servers - **Create projects** — spin up new projects Project ### Which projects can they see and edit? - **All projects** — every project in the account - **Specific projects** — pick the ones they need - **Update configuration** — non-sensitive project settings - **Manage config files** — create, edit, delete - **Cannot delete** — protected unless explicitly granted Server ### Where in a project can they deploy? - **Any server** — deploy to anything in the project - **Specific servers** — only the targets you list - **Server groups** — grant access by environment - **No deploy** — read access without the deploy button - **Per-project** — server permissions are project-scoped ## Teams — Permissions That Scale Stop setting permissions one user at a time. Teams group users together, share permissions, and inherit project access. Available on Business & Enterprise. ### Group users, share permissions Instead of clicking through each user every time you add a project, create a team like "Deploy Engineers" or "Agency Clients", give it the permissions and project access once, and add users to inherit it. ### All Projects, with exclusions When a team is set to "All Projects", you can still mark specific projects as off-limits — useful when one or two projects contain sensitive credentials that only certain people should see. The team listing shows "All Projects (N excluded)" so you always know the score. ### Users in multiple teams A user can belong to multiple teams; their effective permissions are the union of every team they're in plus any direct user grants. DeployHQ applies the "most permissive wins" rule consistently across all overlapping grants. TeamDeploy Engineers All Projects (2 excluded) ABMKJR+5 TeamAgency Clients Specific Projects · 3 selected TLCN TeamFinance Billing only · No project access PD The one rule ## Most permissive access wins When a user has the same project granted through multiple routes — say, a team that includes it plus a direct assignment — the broadest grant is the one that applies. Excluding a project from one team doesn't hide it if another route still grants access. That keeps the model predictable and explicit. - Excluding a project on Team A doesn't hide it if Team B grants it - Direct user assignment always coexists with team grants - To remove access, remove every route that grants it ## Real-World Setups Common patterns we see across agencies, in-house teams, and regulated industries. ### Agency with client isolation One team per client, each scoped to that client's projects only. Add contractors to the relevant team for the duration of the engagement; remove them when it ends. Clients never see each other's projects. ### Finance access without deploy keys A "Finance" team with **Manage billing** enabled and no project access. They see invoices and update payment methods but cannot deploy, view code, or touch infrastructure. ### Junior devs locked to staging Project access enabled, but server permissions restricted to the _staging_ server group. They can deploy freely to staging and never accidentally promote a change to production. ### Sensitive projects, broad team "Deploy Engineers" team gets All Projects access, but two projects (containing sensitive infrastructure) are listed as exclusions. Only the two named admins on those projects can see them. Getting Started ## Invite your first teammate in under a minute ![Check mark](/assets/icons/tick-01ba7f4740d492a18fbdf4424bf7446c87ddfccbc0157214ad536b11512e914d.svg) ### Open User Management Settings → Account → User Management. Click New User. ![Check mark](/assets/icons/tick-01ba7f4740d492a18fbdf4424bf7446c87ddfccbc0157214ad536b11512e914d.svg) ### Pick the scope Account permissions (admin, billing, agents), then project access (all or specific). Drill into server access if you need finer control. ![Check mark](/assets/icons/tick-01ba7f4740d492a18fbdf4424bf7446c87ddfccbc0157214ad536b11512e914d.svg) ### Or build a Team (B/E plans) Settings → Account → Team Management. Create a team with the permissions you want, then drop users in. They inherit everything automatically. [Read the documentation →](https://www.deployhq.com/support/users) PERMISSION LAYERSACCOUNTadmin · users · billing · agents · createPROJECTall projects · specific · configSERVERper-server / per-groupStacks from broad to narrow · most permissive wins ## Frequently Asked Questions ### How many users can I have on a DeployHQ account? There is no seat limit on Pro, Business, and Enterprise plans — add as many users as you need. Pricing is based on projects and channels, not headcount. This is unusual in the deployment-platform market and makes DeployHQ a strong fit for agencies and large in-house teams. ### Are Teams available on every plan? Individual user permissions are available on every plan. Teams (group-based permissions with shared project access) are available on Business and Enterprise plans. If you're on a smaller plan and want team-level grouping, upgrading is the way in. ### How does DeployHQ handle overlapping permissions? The most permissive grant wins. If a user has the same project granted through Team A and a direct user assignment, the broader of the two applies. To revoke access, remove every route that grants it — excluding a project from one team doesn't hide it if another team or direct grant still includes it. ### Can I restrict a user to deploy only to certain servers? Yes. After granting project access, you can switch off 'can deploy to any server' and add per-server or per-server-group permissions. A common pattern is to let junior devs deploy to staging freely and require a separate role for production. ### Does DeployHQ support 2FA and SSO? Two-factor authentication is supported across every plan, including SMS recovery via Twilio. Single sign-on with your identity provider is available on Enterprise plans. ## Bring your whole team — give each one the right keys Unlimited users on Pro, Business and Enterprise. No per-seat invoices to apologise for. [Start Free Trial](/signup?cta=Start+Free+Trial) 10-day free trial • No setup fees • Cancel anytime ## Explore More Features Discover all the tools that make DeployHQ the easiest way to deploy your code. [ ### Zero Downtime Deployments →](/features/zero-downtime-deployments)[ ### One-Click Rollback →](/features/one-click-rollback)[ ### Turbo Deployments →](/features/turbo-deployments)[ ### Build Pipelines →](/features/build-pipelines)[ ### Build Cache →](/features/build-cache)[ ### Scheduled Deployments →](/features/scheduled-deployments)[ ### Deployment Availability →](/features/deployment-availability)[ ### Docker Builds →](/features/docker-builds)[ ### Deployment Checks →](/features/deployment-checks)[ ### Deployment Targets →](/features/deployment-targets)[ ### Automatic Deployment →](/features/automatic-deployments)[ ### Deployment Templates →](/features/deployment-templates)[ ### Deploy Behind Firewalls →](/features/deploy-behind-firewalls)[ ### SSH Deployment →](/features/ssh-deployment)[ ### Deployment Zones →](/features/deployment-zones)[ ### Team & Permissions →](/features/team-permissions)[ ### Single Sign-On →](/features/sso)[ ### Custom Actions →](/features/custom-actions)[ ### Server Management →](/features/server-management)[ ### CLI & Agents →](/agents)[ ### Powerful Integrations →](/features/integrations) ## Get started today for just $9/month That's unlimited deployments and 3 projects. [Start your free 10 day trial](/signup?cta=Start+your+free+10+day+trial)