Access and Permissions

There are four access types: account owner, administrator, unit manager and employee, who sees only their own data.

"Grant access" sends employees without an account an invitation to create a password, up to 200 people at a time; the link is valid for 48 hours and works once. "Revoke access" also closes the person's open sessions, and the last active administrator can't be revoked.

The Settings tab manages Google sign-in (allowed domains, required Workspace account, Google-only sign-in and emergency accounts), the password policy and two-step verification methods. An authenticator app, passkeys and SMS can be offered as the second step, and before you make it mandatory the screen shows how many accounts have no second step yet.

• Statuses: active, invitation pending, revoked, no access
• Sign-in: password, Google sign-in, two-step verification
• Invitation: valid for 48 hours, single use

People don't get roles, they get positions; the roles on a position combine into the person's permissions.

On the Role Permissions screen, web and mobile permissions are ticked in the same tree, section by section, and a section row applies to everything below it. "Create a copy" opens a new role with the same permissions.

Action permissions, which unlock actions rather than screens, are listed separately. The last role giving the root position access to Role Management can't be deleted, so an administrator can always get back in to fix a mistake.

• Columns: web, mobile, positions, people
• Role types: page role, action permission

Seeing a screen and performing a critical action on it are separate permissions.

Positions sit side by side as cards; making a change enables Save and Cancel, and nothing changes until you save.

Broad permissions, such as reports independent of the hierarchy or reports for head office and other branches, are also granted to positions here.

• Examples: delete person, bulk update, edit approved leave
• Scope: report visibility, publishing announcements

Roles decide which screens open; unit authorization decides whose data appears on them.

Each authorized person has three options: access to payment and salary data, reports for their own unit, and view only. The same person can be authorized for several units.

Unit managers run reports only for their own units and open records only for employees in the units they are authorized for.

• Tabs: branch, department, position
• Options: salary access, unit reports, view only

No setting ever exposes personal phone numbers or someone else's leave balance to employees.

Visibility by unit lets employees see colleagues only within the same branch, department or position. With files and assets turned on, employees see only their own.

Request and Profile Settings work the same way: they choose which request types employees can submit and which profile sections they can update themselves.

• Home page: headcount breakdown, upcoming leave, birthdays, events
• Employees: records, work phones, org chart, custom fields
• Reports: let managers run reports for their own teams

When an employee changes phones, the old device record is deleted and they sign in from the new one.

Select people and use "Delete Mobile Device" to remove several at once, or double-click a row to remove one.

The app version column makes it easy to spot people still running an outdated version.

• Filters: site, person type
• Details: model, version, language, last access

Only the account owner can open sensitive requests, confirming that written approval with authorized signatures will follow.

Data deletion can't be undone; it covers employees' personal data, files, leave, training and expense records and, where used, performance, payroll and shift data. Each request is reviewed and carried out by hand; the screen doesn't delete anything on its own.

Anyone can open other requests, such as feature requests or demo and meeting requests.

• Sensitive: data deletion, data export, account owner change
• Tracking: status, withdrawal, reply