Users and permissions

Each organization has its own user list. Check the selected organization before inviting someone or changing their permissions.

Choose a role

This matrix describes actions offered in the application for a role assigned directly in the organization. Service access also depends on subscription status.

Action	Owner	Member	Reader	Billing
View and search logs	Yes	Yes	Yes	No
Download logs and prepare personal period exports	Yes	Yes	Yes	No
View and export audit logs	Yes	Yes	Yes	No
Create, update or delete a location	Yes	Yes	No	No
Add or remove allowed IP addresses	Yes	Yes	No	No
View the user list	Yes	Yes	Yes	No
Invite, remove a user or change their role	Yes	No	No	No
Update or delete the organization	Yes	No	No	No
View the plan	Yes	Yes	Yes	Yes
Manage the subscription and payment methods	Yes	No	No	Yes

Reader does not mean “no downloads”. This role can retrieve copies of logs. Requests displayed in My exports belong to the account that created them.

Additional permissions may come from MSP access to a linked organization. If access remains after an organization role is removed, also check that membership with your administrator.

Invite someone

Open Users in the relevant organization.
Select the invitation action.
Enter the email address and choose a role.
Send the invitation; the person must accept it to join the organization.

Invitations explains how to accept, reject and track invitations. If the user limit blocks an invitation, see Plans and usage.

Change or remove access

In Users, select the role change or removal action for the relevant person. These actions require the Owner role.

Then check the user list and audit logs. Already downloaded files cannot be recalled, and previously issued links may remain usable until they expire.

Troubleshoot access

An action is missing or denied: check your role, selected organization and subscription status.
An invitation remains pending: verify the invited address and ask the person to open Invitations using that same account.
Someone must no longer access logs: remove direct access and have any MSP access checked as well.

Allowed IP addresses control log sources; they do not grant permissions to application users.