Team & permissions

This page covers how to invite teammates, what roles to give them, and how per-panel permissions work for fine-grained control.

Inviting a teammate

Account → Users → + Invite User:

1. Email — they'll receive an invitation.
2. Role — viewer / editor / admin (see below).
3. Per-panel permissions (optional) — restrict access to specific panels.

The invitee receives an email with a link, sets a password, and is in. Invitations expire after 7 days; resend if needed.

The three CMS roles

• Viewer — read-only across the entire admin panel. Can see everything but can't change anything. Use for board observers, donors with portal access, auditors.
• Editor — can edit content (CMS, events, donations) but can't change settings, billing, or user permissions. Use for staff doing day-to-day operations.
• Admin — full access to everything except billing and user management. Use for senior staff.

Plus there's Owner — only set per-tenant or per-org. Owner can do everything including transfer ownership and close the tenant.

Per-panel permissions

For tighter control, layer per-panel permissions on top of role:

• Viewer + Donations panel — sees only donations, nothing else.
• Editor restricted to CMS — can edit content but not see donor data.
• Admin minus Billing — does everything except change the credit card.

Set up in Account → User Permissions by selecting a user and toggling specific panels.

Audit log

Every meaningful action is logged in Activity Log:

• Who did what, when.
• Old and new values for every change.
• IP address and browser.

Use this to:

• Investigate "who deleted X?" questions.
• Confirm suspicious activity.
• Generate compliance reports.

MFA (multi-factor authentication)

Strongly encouraged — especially for Owners and Admins. My Profile → Security → Enable MFA sets up TOTP via authenticator app (Google Authenticator, 1Password, Authy, etc.).

Once enabled, login requires the rotating 6-digit code in addition to password.

Removing access

When a teammate leaves:

1. Cancel their invitation if not yet accepted.
2. Demote to Viewer as a soft step (preserves audit trail).
3. Remove from team when fully transitioned.

Removing doesn't delete their record — past actions still show in the audit log with their name. This is by design.

Departments (optional)

For larger orgs, group users into departments (Programs, Development, Marketing, Finance). Departments are used for:

• Filtering reports.
• Routing notifications.
• Permission templates ("everyone in Development gets these panels").

Set up in Account → Departments.

Common patterns

• Owner = ED + Board chair — at most 2 owners per tenant.
• Admin = senior staff — small number, typically 2–5.
• Editor = day-to-day team — most users.
• Viewer = board members + interns — read access without risk of changes.
• Always enable MFA on Owners.