Team and roles

Four roles, from read-only to owner. What each may do, and how to choose one for a new member.

Manage your team on Team in your console. Only an owner can invite, change or remove a member.

The roles#

Role	In one sentence
Auditor	Read-only. Can see everything and change nothing.
Helpdesk	Day-to-day support — unlock people, end a session, lift an IP block. Cannot change policy.
Administrator	Security policy and settings. Cannot manage the team or reach credentials.
Owner	Everything, plus the team, billing, database credentials and deleting this tenant.

Each role includes everything the one above it in this table can do.

What each action needs#

Action	Minimum role
See every page of the console	Auditor
Change alert rules and who is told	Helpdesk
Lift an address block	Helpdesk
Change notification settings	Helpdesk
End a session, force a password reset	Helpdesk
Change the sign-in page branding	Administrator
Clear sign-in logs	Administrator
Change network, device, password, lockout, session, MFA and captcha settings	Administrator
Export monitoring data	Administrator
Change collection levels, retention and pseudonymous view	Administrator
Change tenant settings	Administrator
Create, change and test webhooks	Administrator
Choose a plan and pay for it	Owner
Change the database or directory connection	Owner
Rotate the keys your application trusts	Owner
Erase the records held about a person	Owner
Invite, change and remove team members	Owner
Publish, suspend, or schedule deletion of the tenant	Owner

Choosing a role#

Person	Role
An auditor, a manager who wants to look, a customer's security reviewer	Auditor
The support desk that unlocks people and answers "I cannot sign in"	Helpdesk
The engineer or security lead who writes policy	Administrator
The person who answers for the account: billing, the team, the database connection	Owner

Give the lowest role that lets someone do their job. Keep two owners, so that one person leaving does not lock the account.

What a role cannot do#

A member can open every page. An action above their role is refused.

Every change any member makes is recorded in the audit log, with their name.

Support access: when our operators can change your settings#

Your settings are yours. The operators who run the platform can read your configuration, because that is how they help you: one page that lists what each policy is set to. They cannot change it. Not the network or device policy, not MFA, not your password policy, not your database credentials.

There are two ways that changes, and you are told about both.

	Who opens it	For how long	What you see
Support access	An owner of your console, from Settings	1 hour, 24 hours, 3 days: you choose	The panel says it is open and until when. Close now shuts it at once.
Emergency access	A platform super-admin, without you	60 minutes	A critical notification, an e-mail to your contact address and an entry in your audit log, each with the reason they typed. You can shut it from the same panel.

Emergency access exists for one case: you are locked out of your own console and cannot open anything, for example because a policy you saved refuses your own country. It needs a written reason, and only a super-admin can open it.

While either is open, every change an operator makes is in your Audit Log under their name, marked platform operator. The Support access panel keeps the history: each time it was opened, by whom, for how long and how it ended.

What the platform's operators do without asking is their own side of the service: approving and suspending a tenant, licences and plans, invitations and offboarding.

Something missing or wrong on this page? Tell us and we will fix it.