filipagr · Nov 13, 2026 · Nov 11, 2026
diff --git a/docs/app/api-keys.mdx b/docs/app/api-keys.mdx
@@ -16,18 +16,21 @@ The page has two tabs, **API keys** and **Connection details**. The table shows:
 | **Name** | The key name, with the Access Key ID underneath and a copy button |
 | **Region** | The region the key belongs to, such as `eu-west-1` (hidden on narrow screens) |
 | **Buckets** | **All Buckets**, or one badge per bucket the key is scoped to |
-| **Permissions** | Badges for the object permissions, with the finer-grained ones grouped into **Data protection**, **Bucket management**, and **Bucket info** |
+| **Permissions** | Badges for the object permissions (**Read**, **Write**, **List**, **Delete**), and a **+***n* badge for the rest. Open the key to see them all |
 | **Created by** | The member who created the key, and **Rotated by … on …** once it has been rotated. Shown when your organization has more than one member |
-| **Status** | **Active** |
-| **Last Used** | **Never** |
+| **Status** | **Active**, or **Expired** once the key's expiry date has passed |
 | **⋯** | **Rotate** and **Delete**, for the keys you can act on |
 
-With no keys yet the page reads **No API keys yet** and offers **Create your first key**.
+With 5 or more keys, a **Search keys** box (by name or Access Key ID) and filters for region (**All regions**) and status (**All statuses**) appear above the table.
+
+Click a key's row to open its details: its **Status**, when it **Expires** (or **Never**), when it was **Created** and **Rotated**, its **Region**, which **Buckets** it reaches ("All buckets in this region" for an unscoped key), and its full **Object permissions** and **Bucket management** permissions. The details panel is the place to check a key's expiry date.
+
+With no keys yet the page reads **No API keys yet** and offers **Create your first key**. A Member sees "You can only see the keys you create. Owners and Admins see every key in the organization." instead, because the organization may hold keys they aren't shown.
 
 If your account is disabled, the **API Keys** page shows only a notice asking you to reactivate your subscription, with no keys, tabs, or **Create new key** button.
 
-:::note Keep your own record of each key
-**Last Used** and **Status** are placeholders for now: every key reads **Never** and **Active**, and the expiry date you set is not shown in this list. Note down what each key is for and when it expires, and give keys descriptive names so the **Name** column carries that context for you.
+:::note Name keys for what uses them
+The console doesn't show when a key was last used. Give each key a descriptive name, such as `backup-job-prod`, so you can tell from the list which application would break if you deleted it.
 :::
 
 ## Who can manage keys
@@ -38,7 +41,7 @@ What you can do here depends on your [role](/app/organization#roles-and-permissi
 - **Members** see, rotate, and delete only the keys they created themselves.
 - **Admins** and **Owners** see and manage every key in the organization.
 
-A key can only carry permissions your role holds, and the form hides the ones it doesn't. **Set retention** and **Set legal hold** are Owner-only, so they appear only for Owners. If a member's role is narrowed, any key they created that the new role couldn't create is revoked, and removing a member revokes the keys they created.
+A key can only carry permissions your role holds, and the form hides the ones it doesn't. **Set retention** and **Set legal hold** are Owner-only, so they appear only for Owners. If a member's role is narrowed, any key they created that the new role couldn't create is revoked, and removing a member revokes the keys they created. The member is emailed a list of the revoked keys. See [Organization](/app/organization#removing-a-member).
 
 ## Creating a key
 
@@ -57,7 +60,7 @@ Click **Create new key**, which opens a dedicated page.
 | **List** | Browse and list objects |
 | **Delete** | Permanently remove objects |
 
-**Read**, **Write**, and **List** are pre-selected. **Delete** is not.
+**Read**, **Write**, and **List** are pre-selected. **Delete** is not. For a read-only key, untick **Write**: a key with **Write** can overwrite any object it reaches.
 
 Checking one of those reveals finer-grained permissions nested underneath it. These are granted individually, so tick the ones you need:
 
@@ -76,14 +79,16 @@ A key with **Write** therefore needs **Set retention** ticked as well before it
 
 **Which buckets can this key access?** Defaults to **All buckets**, meaning every bucket in the key's region. Choose **Specific buckets** to pick from a list, filtered to the region you selected.
 
-**When should it expire?** **Never expires** (the default), **30 days**, or **Custom** with a date picker.
+**When should it expire?** **Never expires** (the default), **30 days**, or **Custom** with a date picker. A key with an expiry date works through the whole of that day (UTC) and stops at the start of the next one.
 
 Click **Create API key** to create it.
 
 ## Saving the secret
 
 On success a **Save your credentials** dialog shows the **Access Key ID** and the **Secret Access Key**, with the secret masked until you reveal it. You can copy either, or download the pair as a `.csv` or `.env` file.
 
+A downloaded file holds the secret in plain text. Move the values into your password manager, secrets store, or your tool's credential file, then delete the download. Never commit it: if you keep a `.env` in a project, add it to `.gitignore` first.
+
 :::warning The secret is shown once
 Fil One never stores your secret, which is why it appears only when a key is created or rotated. Copy or download it before closing the dialog. If you lose it, [rotate the key](#rotating-a-key) to get a new secret.
 :::
@@ -103,11 +108,15 @@ After a rotation, the **Created by** column shows who rotated the key and when.
 
 ## Revoking a key
 
-Open the **⋯** menu on the key's row and choose **Delete**. The dialog warns that the key will be permanently revoked and that any application using it loses access immediately.
+:::warning Deleting a key breaks anything that uses it
+A deleted key stops working immediately and can't be restored. To move an application onto a key with different permissions or buckets, create the new key first, switch the application over, then delete the old one.
+:::
+
+Open the **⋯** menu on the key's row and choose **Delete**. The dialog warns that the key will be permanently revoked and that any application using it loses access immediately. Deleting a key is how you revoke it.
 
-Deleting a key is how you revoke it. To move an application onto a key with different permissions or buckets, create the new key first, switch the application over, then delete the old one.
+To delete several keys at once, tick their checkboxes (or the header checkbox). A bar shows *n* **selected** with **Clear** and **Delete**. Only keys you're allowed to delete can be selected.
 
-Revocation is confirmed with the storage operator before the key leaves your list, so a key that is still listed is a key that is still live. That ordering means the list stays a truthful picture of what has access.
+A key stays in your list until its revocation is confirmed, so a key that is still listed is a key that still works.
 
 :::note Keys for a bucket
 A bucket's **API Keys** tab shows the keys that can reach that bucket, which is a quicker way to audit access for one bucket than reading down the full list.

diff --git a/docs/app/billing.mdx b/docs/app/billing.mdx
@@ -3,7 +3,7 @@ title: Billing
 description: Reading the Fil One billing page, adding a payment method, and finding your invoices.
 ---
 
-Billing is a page of its own, at `/billing`. Open it from **Billing** in the organization menu, at the top of the left sidebar (see [The organization menu](/app/organization#the-organization-menu)).
+Billing is a page of its own, at `/billing`. Open it from **Billing** in the **Organization** group of the left sidebar (see [Where to find the organization's pages](/app/organization#where-to-find-the-organizations-pages)).
 
 Billing is visible to **Owners** and **Admins**. Every action on it (choosing or changing a plan, adding or updating a card, opening the Stripe portal) is for **Owners** only, so an Admin sees the same figures without the buttons. Members and Read only users see "Billing is managed by your organization's owners and admins" instead. See [Roles and permissions](/app/organization#roles-and-permissions).
 
@@ -15,17 +15,20 @@ The **Plan** card names your plan and carries a status badge:
 
 | Status | Badge | Plan name and detail line |
 |--------|-------|---------------------------|
-| Trial | **Trial** | **Free trial**, with how many days until the trial ends. The trial's storage and egress limits are on the [usage card](#usage) |
-| Paid | **Active** | **Pay as you go**, with your per-TB rate and the renewal date |
+| Trial | **Active** (blue) | **Free trial**. The trial's storage and egress limits are on the [usage card](#usage) |
+| Paid | **Active** (green) | **Pay as you go**, with your per-TB rate and the renewal date |
+| Billed manually | **Active** (green) | The name on your agreement, or **Custom plan**, with **Billed manually** |
 | Payment failed | **Payment failed** (amber) | Your plan name, rate, and renewal date, as for a paid plan |
 | Grace period | **Grace period** | Your plan name and rate, and how many days until access ends |
 | Canceled | **Canceled** | Your plan name and rate, and the date it was canceled |
 | No plan | None | **No plan**, with **Choose a plan to start storing data** |
 
-If your plan was set up with the sales team, the card shows the name on your agreement, and **Custom pricing** where there is no single per-TB rate to show.
+If your plan was set up with the sales team, the card shows the name on your agreement, and **Custom pricing** where there is no single per-TB rate to show. An organization billed manually by the sales team has no payment method to manage in the console.
 
 The button in this card is **Upgrade** on the trial, **Manage plan** on a paid plan (including one whose payment failed), **Reactivate** once the subscription is canceled, and **Choose a plan** during the grace period or with no plan.
 
+A canceled subscription can be restarted at any time: an Owner clicks **Reactivate**, and the banner confirms "Your data is still here." Access returns as soon as the new subscription starts, without contacting support.
+
 A banner above the cards flags a problem with the account:
 
 | Banner | Button |
@@ -67,7 +70,7 @@ The **Payment method** card shows one of three things:
 **Update**, **Manage**, and **Manage plan** open the Stripe customer portal, where the card details are entered and stored. Fil One does not hold your card number.
 
 :::note Cancelling
-Cancellation is handled in the Stripe portal, reached through **Manage plan**.
+Cancellation is handled in the Stripe portal, reached through **Manage plan**, so only Owners can cancel.
 :::
 
 ## Choosing a plan

diff --git a/docs/app/buckets.mdx b/docs/app/buckets.mdx
@@ -19,24 +19,28 @@ Each row has an actions menu with **Browse objects**, **Copy bucket name**, **Co
 
 ### Deleting a bucket
 
-Choose **Delete bucket** from the row's actions menu and confirm. Only empty buckets can be deleted: if the bucket still holds objects or object versions, the console says it is not empty and links to how to empty it. Use [Empty bucket](#emptying-a-bucket) first, then delete. Deletion is permanent.
+:::warning Deleting a bucket can't be undone
+A deleted bucket can't be restored, and applications that use it start failing straight away.
+:::
+
+Choose **Delete bucket** from the row's actions menu and confirm. Only empty buckets can be deleted: if the bucket still holds objects or object versions, the console says it is not empty and links to how to empty it. Use [Empty bucket](#emptying-a-bucket) first, then delete.
 
 **Delete bucket** is only shown to Owners and Admins. It works in every region, including `eu-west-1`, where `DeleteBucket` is not available over the S3 API. See [Buckets](/storage/buckets#deleting-a-bucket).
 
 ## Creating a bucket
 
-Click **Create bucket** and fill in:
+Click **Create bucket** (or **New bucket** on the Dashboard) and fill in:
 
-1. **Bucket name.** 3 to 63 characters, lowercase letters, numbers, and hyphens only, starting and ending with a letter or number. No dots, unlike AWS S3. Must be globally unique.
+1. **Bucket name.** 3 to 63 characters, lowercase letters, numbers, and hyphens only, starting and ending with a letter or number. No dots, unlike AWS S3. The form says it "must be unique in this region".
 2. **Region.** Europe (France) `eu-west-1`, the default, or US East (Michigan) `us-east-1`. This sets the endpoint you connect to.
-3. **Object settings**, three switches that nest inside one another, all off by default:
+3. **Advanced settings**, collapsed by default because most buckets don't need them. Expand it to set three switches that build on one another, all off by default:
    - **Versioning** keeps multiple versions of an object.
-   - **Object Lock** requires Versioning to be on, and stays greyed out until it is.
-   - **Retention** requires Object Lock, and stays greyed out until it is. Turning it on reveals a **Default Retention Policy** with **Governance** or **Compliance** mode (Governance by default) and a **Lock period** in **Days** or **Years**, defaulting to 15 days. The maximum is 100 years.
+   - **Object Lock** can't be turned on until Versioning is, and shows a **Needs Versioning** badge until then.
+   - **Retention** can't be turned on until Object Lock is, and shows a **Needs Object Lock** badge until then. Turning it on reveals a **Default Retention Policy** with **Governance** or **Compliance** mode (Governance by default) and a **Lock period** in **Days** or **Years**, defaulting to 15 days. The maximum is 100 years.
 
-Turning a parent switch back off resets the ones nested inside it.
+   Turning a switch back off resets the ones that depend on it. While the section is collapsed, the line beside it lists what is on.
 
-You can also expand **Create new key** to generate an access key alongside the bucket. It is pre-scoped to the bucket you are creating and to that bucket's region, and the submit button changes to **Create bucket and API key**. The secret is shown once, in a dialog. The console then opens the new bucket's page.
+Click **Create bucket**. The console opens the new bucket, and its empty state offers **Create API key** (or **View API keys**, if you already have keys that reach it) so you can connect an application.
 
 A panel headed **Included by default** confirms two things you do not configure: all data is encrypted at rest, and every bucket is private, so access requires an API key.
 
@@ -46,7 +50,7 @@ Name, region, versioning, Object Lock, and the default retention policy are all
 
 ## Inside a bucket
 
-Opening a bucket shows its region, storage used, and creation time, then three property cards: **Versioning** and **Object Lock** (each **Enabled** or **Disabled**), and **Retention**, which shows the default retention policy, such as **Compliance · 15 days**, or **None**. Encryption is on for every bucket, so it has no card of its own.
+Opening a bucket shows its region and storage used, then three property cards: **Versioning** and **Object Lock** (each **Enabled** or **Disabled**), and **Retention**, which shows the default retention policy, such as **Compliance · 15 days**, or **None**. Encryption is on for every bucket, so it has no card of its own.
 
 Once the bucket holds objects, **Empty bucket** and **Upload object** buttons appear in the header. While it is empty, the upload button sits in the empty state instead.
 
@@ -61,7 +65,7 @@ The object table shows **Name**, **Size**, and **Last Modified**, plus **Version
 
 On a versioned bucket, a key with more than one version gets an expander and an *n* **versions** pill. Expanding shows the older versions, badged **Latest** for the current one and **Delete marker** where a delete marker sits on top.
 
-Per-row icon buttons download or delete a single object. A checkbox on each row, and on the header, lets you select several at once. See [Deleting objects](#deleting-objects).
+Per-row icon buttons download, share, or delete a single object. A checkbox on each row, and on the header, lets you select several at once. See [Deleting objects](#deleting-objects).
 
 :::note Large buckets
 The browser shows the first page of results, around 1,000 entries. When there are more, an amber **Showing the first** *n* notice appears, and selecting and deleting apply only to the objects listed. The count on the **Objects (N)** tab then comes from your bucket analytics, a daily reading that can lag recent changes, so expect it to be higher than the number of rows in view. Use the AWS CLI or an SDK to page through a full listing, or [Empty bucket](#emptying-a-bucket) to remove everything. See [Objects](/storage/objects).
@@ -118,6 +122,10 @@ An object under an active retention period or legal hold is protected, and attem
 
 ### Emptying a bucket
 
+:::danger Empty bucket permanently deletes everything in the bucket
+It removes every object, every earlier version, and every delete marker that isn't protected by retention or a legal hold. It can't be undone, and versioning doesn't protect you: nothing is kept to restore from.
+:::
+
 **Empty bucket** on the bucket page removes every object in the bucket, including every earlier version and delete marker. Type the bucket name to confirm, then click **Delete everything**.
 
 The deletion runs on the server, so it is not limited to the objects listed on screen, and it keeps running if you close the dialog. When it finishes, the dialog reports **Bucket empty**, **Some objects remain** (with how many could not be deleted, for example because they are under active retention), or **Deletion stopped** if the job could not complete.

diff --git a/docs/app/dashboard.mdx b/docs/app/dashboard.mdx
@@ -3,21 +3,13 @@ title: Dashboard
 description: What the Fil One dashboard home page shows, and how to read its usage figures.
 ---
 
-The dashboard at [app.filone.com](https://app.filone.com) is the home page of the console, reached from **Dashboard** at the top of the left sidebar. It summarises your plan, usage, and recent activity. A **New bucket** button sits in the header, and during the trial a banner shows the days left with an **Upgrade** button.
+The dashboard at [app.filone.com](https://app.filone.com) is the home page of the console, reached from **Dashboard** at the top of the left sidebar. It summarises your plan, usage, and recent activity. A **New bucket** button sits in the header. During the trial, a **Free trial** banner shows the days left and an **Upgrade** button. You can dismiss it with its **×** button.
 
 For sign-in methods, email verification, two-factor authentication, and passkeys, see [Account Security](/security/account-security).
 
-## Quick setup
+## Get started
 
-Until you have created a bucket, uploaded an object, and generated an API key, a **QUICK SETUP** card tracks your progress as *n* of 3. Each step turns green when it is done:
-
-| Step | Takes you to |
-|------|--------------|
-| **Create a bucket** | Your bucket list |
-| **Upload an object** | Your bucket list, where you open a bucket and upload into it |
-| **Generate API key** | The API keys page |
-
-The card disappears once all three are complete.
+A new organization opens on a **Get started** page instead of the dashboard, because its dashboard would be all zeros. The page offers **Create bucket** and **Create API key**, which change to **Create another bucket** and **Create another key** once you have one. Below them, **Explore more** links to inviting your team, these docs, and the Fil One team. The page stays at `/get-started` if you want to come back to it.
 
 ## Plan, storage, and egress