Every account, from created to retired, under rules you wrote.

Does Sharetru have three roles — Administrator, Team Manager and User?

No. Sharetru has eight system role groups plus group managers scoped to one access group; the three-role description came from an earlier version of this page. Team Managers are a legacy structure that the Groups system replaced, and sites still using them should migrate to access groups with group managers.

Can an MSP or an auditor manage or inspect my site without seeing my files?

Yes. A user whose only role is MSP Administrator manages users, groups and settings and sees the folder tree, but cannot open files. Because the role can assign other roles, give it only to people you trust with that.

The two Auditor roles are read-only everywhere: a Site Auditor sees settings, users, permissions and reports but no file names; a Files Auditor sees folder and file names but cannot open, download or preview a file. Privileges add up across roles, so give an MSP or an auditor only that role.

Can one user hold more than one role?

Yes — a user may belong to several role groups at once, and the privileges add up. So give an MSP or an auditor only that role: a user who holds either one together with File Administrator can open files.

Is there a second approval for new accounts?

Yes, on Complete — with dual authorization on, a new account is held as pending until a New User Authorizer approves it, and the Authorizer can never be the person who created it. Both the request and the decision are emailed.

How do I add many users at once?

Import a CSV: Sharetru gives you a sample template, checks every row and shows a row-by-row error report before anything is committed. With invitations on, each new user receives a link and chooses their own first password; with dual authorization on, each one still waits for approval.

What happens after repeated failed logins?

The account lockout policy locks both the username and the source IP address at the limits you define; on Sharetru Federal, three failed attempts within fifteen minutes locks the account for sixty minutes. Current lockouts sit in one table where an administrator can inspect the details and clear them.

What is default site authentication?

Default site authentication is Sharetru’s native sign-in, built into the application: a username and password checked by Sharetru under your password policy, with a one-time code by authenticator app, email or SMS, or an SSH key for SFTP and SCP. Every account uses it unless you assign the account to an identity service for single sign-on — and it is what partners, auditors and service accounts keep when your staff move to SSO.

Does Sharetru support single sign-on, and with which providers?

Yes — on the Complete plan, over SAML 2.0 or OAuth, with documented setup for Microsoft Entra ID, Okta, Auth0, OneLogin and PingOne. It is chosen per user, so staff can sign in through your directory while partners and service accounts stay on default site authentication. Each SSO user still exists as a Sharetru account with its own folder grants: your directory decides whether they can log in, Sharetru decides what they can reach.

Does Sharetru’s MFA apply to SSO users?

No. When a user authenticates through your identity provider, every factor — MFA included — is your identity provider’s, and no part of Sharetru’s own sign-in is used. Sharetru’s one-time codes apply to accounts on default site authentication.

Can a service account sign in without a password?

Yes — attach an SSH public key (RSA or ECDSA) to the account and switch it to key authentication for SFTP and SCP. Add an IP rule: the key proves the account, and the address limits where it can connect from. Sharetru’s host keys are published under Site Identity so your scripts can pin them.

What does Sharetru Federal preset for authentication?

Sharetru Federal arrives with the FedRAMP Moderate baseline preset: MFA required by authenticator app only with five-minute codes; account lockout after three failed attempts in fifteen minutes, for sixty minutes; password expiry within 90 days and no re-use for 90 days or five changes; inactive accounts suspended within 90 days and removed within 30 more, with at least ten days’ notice; country access on with the United States always allowed; a system-use announcement at sign-in; and personal data masked in the interface.

Can I change the Federal presets?

You can tighten them, and you can add countries; you cannot loosen anything else. Every Sharetru site starts locked to the United States, so adding a country is expanding country access, and that is yours to do on Federal as on Commercial. Beyond that: suspend inactive accounts sooner than 90 days, expire passwords sooner, require more than the baseline — but SMS and email codes stay off, the announcement stays on, and the ceilings stay where FedRAMP put them.

Can I control which email domains a share link may go to?

Yes — a site-level allow-list or block-list of email domains decides where links may be sent, for every link anyone on your site creates, checked when the link is sent and again when the guest signs in. It is an access control on the people you let in by link, separate from folder permissions and from the per-user IP rules.

Who can delete a file?

Anyone you have given the delete flag on that folder — plus site administrators, file administrators, and group managers with file rights inside their own folders. Sharetru does not keep prior versions of a file, and we will not tell you otherwise.

How does someone become a guest on my site?

Only by receiving a Sharetru link from one of your registered users — there is no self-registration — and only if their email domain passes your allow-list or block-list, which Sharetru checks when the link is sent and again when the guest signs in. Link sharing itself is granted per user by an administrator, so you decide who may send as well as who may receive. The recipient then registers once with that address, a password and MFA when you require it.

Can a guest become a registered user?

Yes — an administrator can convert a guest to a registered user at any time, with no second account to create. As a registered user they sign in to your site, hold folder grants, connect over the web app, SFTP or the API, and count toward your plan.

Is all of this on every plan?

Role groups, access groups, MFA, SSH keys, password strength and expiration, and country access are included on Core and Complete; Core includes five custom access groups and Complete unlimited. SSO, per-user IP restrictions and dual authorization for new accounts come with Complete. The 15-day free trial of Sharetru Commercial includes all of it. Sharetru Federal is an add-on to Core or Complete; SSO, per-user IP rules and dual authorization still need Complete.

Is Sharetru FedRAMP authorized?

Yes: Sharetru Federal is FedRAMP Rev 5 (Class C) Certified (the new name for FedRAMP Moderate), the status FedRAMP formerly called “Authorized”. It is the certified SaaS inside MIS Sciences Corporation’s GovPoint Cloud Services, package F1311222650 (Class C, Moderate), and FedRAMP maintains the listing on the FedRAMP Marketplace. Sharetru Commercial is not part of the package.