Sign in once. Move through everything.
S7 Account is the platform authorization server. If you already have a session open in one product, the others let you in without typing anything — the check happens silently, before the screen appears. And the Space you left active comes back on its own at the next sign-in.
What you control
Everything that is yours, in one panel
Three areas, and nothing beyond them: who you are, how you sign in, and where you work.
Your profile
Display name
The name every S7 product shows beside you. Change it in one field and it holds across the platform.
Profile photo
Upload an image and it becomes your avatar. The file lives in your personal area of S7 Storage; the account keeps only the pointer. In other products it appears at the next sign-in.
Interface language
Portuguese, English or Spanish. The choice lives in your profile and travels with you — it is not a preference stuck to this browser.
Storage usage
How much of your space is already used and how much still fits, on the same profile screen.
Access and security
Change your password
We store only an argon2id hash — the text of your password does not exist in the database. Changing it ends all of your sessions and revokes the refresh tokens, including whoever holds your old password.
A session with no token in the browser
Sign-in runs in an OIDC popup with PKCE and the session becomes a __Host- httpOnly cookie. No token ever reaches localStorage — there is nothing for a page script to steal.
Connected apps
See which third-party apps sign in with your S7 account, which data each one receives, and disconnect whenever you want.
Spaces and people
Create and switch Spaces
A Space is the shared workspace, and every resource on the platform belongs to one. You start with your Personal Space; create others and pick which one is active.
Members and roles
Add people who already have an S7 account by email and set each one’s role. Changing a role is one click, and the server refuses the change if the role moved in the meantime.
Transfer ownership
Hand the Space to another member. You stay inside as an admin — and only the new owner can hand it back.
Leave or delete
Leave a Space that is no longer yours, or delete the one you created. Both ask for confirmation, because neither can be undone.
Four roles, one clear rule
Everyone joins a Space with a role, and the role decides what they see and do. The screen hides what you cannot do — but the server is what decides, re-reading your Space membership on every call instead of trusting what the token says.
- owner
Creates, deletes and transfers the Space; sets any role.
- admin
Manages members and the day to day. Does not delete the Space.
- member
Works on the resources of the Space.
- viewer
Read only.
How it works
From the first sign-up to an open product
- Create the accountEmail, password and the code that lands in your inbox. The account only comes into being once the code comes back.
- Get your SpaceThe Personal Space is born with you. Create others for each team or client and bring in whoever works alongside you.
- Open any productFrom the nine-dot launcher. The product recognizes your account and your active Space without asking for anything again.
- Adjust whenever you needName, photo, language, password, members and roles all stay here — the account stays the same one forever.
What holds it up
Security that does not depend on you remembering
None of this is optional and none of it has to be switched on: it is how the platform was built.
Passwords in argon2id
A memory-hard hash on the profile OWASP recommends, with a pepper that does not live next to the hash. Not even we can read your password.
The browser never sees a token
The edge exchanges the OIDC code for tokens server-side and hands the browser only an opaque `__Host-` cookie, httpOnly and pinned to the origin.
RS256 signatures with a public JWKS
Every service verifies the token on its own from the public key, asking no one. An access token lasts 200 seconds; the refresh token rotates on every use, and reusing an old one takes down the whole family.
Isolation between Spaces
The token carries the minimum: who you are, which Space is active and with which role. Every service checks your membership against its own store before answering.
Under construction
Already in the identity service, still without a screen in this SPA. It shows up here when you can actually use it.
A unique nickname
A platform handle of your own, to be found and mentioned by.
Several emails on the account
More than one verified address, with the primary chosen by you.
Contact phone numbers
Phone numbers on the profile — for contact, not as a way to sign in.
Entry by domain
Whoever proves a mailbox on the company domain joins the Space with the agreed role.