Domain capture

Whitelist an email domain on your org. New sweetdocs sign-ups with an email in that domain automatically join the org as Members. No per-person invites needed.

Domain capture is a per-org setting that auto-joins new sweetdocs accounts to the org based on their email domain. Useful when your team is mid-sized and you don’t want to send a per-person invite for every new hire.

It runs off the organizations.domain_whitelist array and the sharing_mode = 'domain' setting.

How it works

When a new user signs up to sweetdocs:

1. Sweetdocs reads the user’s email
2. Extracts the domain (everything after @)
3. Looks for any org with sharing_mode = 'domain' AND that domain in domain_whitelist
4. If found: adds the user to org_members with role member
5. The user is dropped into the org on first login

Domain matching is exact — acme.com matches bob@acme.com but not bob@sub.acme.com. To capture subdomains, add each one explicitly.

Enabling domain capture

Only org Owners and Admins can change the sharing mode and the whitelist.

Domain verification

Currently in v1, domain capture trusts the email domain at face value. Anyone with an email at the configured domain can join as a Member — including accounts you don’t own.

For higher assurance, domain verification (proving you control the DNS for the domain) is on the roadmap. When it ships, domains in the whitelist will need a TXT record in your DNS before captures take effect.

Existing users

Existing sweetdocs accounts — already signed up before you added the domain — do not auto-join when you enable capture. The capture happens at sign-up time only.

To bring existing same-domain users into the org, send them a regular email invite at the role you want.

What new members get

A captured Member starts with:

• Org Member role (default — not Admin or Owner)
• No automatic access to any org library (Members get explicit grants, not blanket access — see Org members + roles)
• Access to their personal library, which exists as it would for any sweetdocs user

To make captured Members productive, set up groups and library ACLs that grant defaults. Common pattern: a “Everyone” group covering all members, with Read on a “Company onboarding” library.

Disabling capture

Switch the org back to members mode (or open). The change takes effect immediately — new sign-ups from the previously-captured domains no longer auto-join.

Existing captured members stay in the org — disabling capture doesn’t retroactively remove them. To remove them, remove them individually from the Members list.

Per-domain captures (multiple domains)

The domain_whitelist is an array, so you can capture multiple domains:

• acme.com (primary)
• acme.co (alternate)
• acme-engineering.com (a separate domain you operate)

Each new sign-up’s domain is checked against the whole list; a match against any of them captures them.

Audit log

Every domain capture is recorded as an event in the org’s audit log — actor (the captured user), event (domain_capture), and timestamp. Useful for reviewing the join history.

What’s not in v1