Re-sharing
When recipients of a shared vault or item may pass access on to others, how the Allow re-sharing option works, and the plan and policy controls behind it.
By default, only you can share what you own. Re-sharing lets a recipient pass access on to someone else — useful when a vault manager should be able to onboard teammates without going through the owner every time. It is off unless you explicitly allow it.
Allow re-sharing on a share#
- Open the share dialog for the vault or item.
- On the PulsVault User tab, tick Allow re-sharing before sending.
- Send the share or invitation as usual. The re-share permission travels with the grant.
Who can actually re-share#
Allowing re-sharing does not turn every recipient into a sharer. For a shared vault, a recipient can invite others only when both are true:
- the vault's sharing settings have re-sharing enabled, and
- the recipient holds the MANAGER access level.
Viewers, editors, and limited users can never re-share, regardless of the flag. The owner can always share their own vault.
Plan availability#
| Plan | Re-sharing |
|---|---|
| Free | Not available |
| Premium | ✓ |
| Family | ✓ |
| Team / Business / Enterprise | Admin-controlled |
If your plan doesn't include re-sharing, the option is rejected at share time — you can still share normally without it.
Controls and safety nets#
- Policy checks still apply. A re-share goes through the same validation as any share: circle rules (family or organization boundaries), external-sharing settings, plan limits, and admin approval where required. Re-sharing never widens what a plan or policy allows.
- The chain is recorded. Every grant stores who it was granted by, and all sharing actions land in the audit trail, so admins can see exactly who gave access to whom.
- Access levels can't escalate. A re-sharer assigns levels from the same set — MANAGER at most, never OWNER.
- Revocation cuts access. The owner (or a manager) can remove any member from the vault's Sharing & members page. For high-value vaults, follow up with a DEK rotation — see Share a vault.
Leave Allow re-sharing off unless you specifically want the recipient to manage access on your behalf. You can always share with additional people yourself.