First-run setup

Signing up leaves you with an account and nothing to put in it. First-run setup produces a workspace someone can actually work in.

1. 1

   Workspace

   Name the workspace your team will share, and pick its URL slug. This is also where the organization accepts the Terms and the Data Processing Addendum - the workspace is the contracting party, so its acceptance is recorded separately from yours.

2. 2

   About you

   Job title, company size, industry, what you plan to use Shortspan for, and how you heard about it. Only the job title is required; it is what marks the step finished, which is how an interrupted session resumes in the right place.

3. 3

   First project

   Projects are the boundary for secrets, infrastructure, and access. Most people start with one named after their main application or environment.

4. 4

   Your team

   Invite the people who need access. Entirely skippable - you can invite anyone later from Team.

The step you are on is worked out from what exists - a workspace, a filled-in profile, a project - rather than from a stored position. That means an invitation accepted in another tab, a project created through the API, or an administrator acting on the account all move you forward correctly, with no stale cursor to drift.

It also means only the current step is reachable. Every step here *creates* something, so there is nothing to go back and edit; a revisitable workspace step would just be a second route to a second workspace. Editing what these steps produced is the console's job, and everything is editable there.

Someone arriving through an invitation link sees a shorter flow. They already have a workspace - the one that invited them - so they are not asked to create another, and they are not an administrator of it, so they are not asked to create projects or invite anyone. They answer the profile step and are done.

The invitation link itself works signed out. You have to be able to see what you are being offered before being asked to make an account for it.

Consent is captured twice, deliberately. Registration records you accepting the Terms; the workspace step records the organization accepting the Terms and DPA, because the organization is the party the contract is with. Both store the version of the terms that was accepted, so which text someone agreed to stays answerable after the text changes.

Marketing consent is separate and optional in both places. Bundling it with the terms is what makes an opt-in unlawful in the EU, so it is its own checkbox with its own timestamp, and declining it changes nothing about your account.

The Free plan is a single seat and does not include team management, so the invite step renders locked with an honest explanation of why rather than accepting invitations it would fail to send. Everything else in setup works identically.

The rest of the product is fully usable on Free: three projects, twenty-five infrastructure resources, ten runbooks, and no limit on secrets. See Plans and limits.