Client access levels
Every client portal account belongs to one client and sees only that client's data. On top of that, each account has one of three access levels, which decide which parts of the portal it shows.
| Level | Sees | Give it to |
|---|---|---|
| Client Administrator | The whole portal for their organisation, including managed credentials, the password vault and all billing | One or two named people per client: owner, office manager, IT lead |
| Client Billing | Dashboard, approvals, invoices and payments, help centre and quick links | A bookkeeper or finance contact |
| Client User | Their own tickets, live chat, help centre and shared documents | Everyone else |
Client Administrators also manage their organisation's items in the password vault.
Set a level
- Open the client and go to its contacts, or open Access › Users & Employees.
- Create or edit the client user, and choose the access level.
- Send the invitation. The person sets their own password from a single-use link. Administrators never set passwords for other people.
Good practice
- Start new contacts at Client User and raise the level when an existing Client Administrator asks.
- Have two Client Administrators per client, so a holiday does not hold up approvals.
- Confirm a level change with an existing administrator at that client, never only with the person asking for more access.
- Review each client's user list at contract renewal. Clients rarely tell you when someone leaves.
When someone leaves a client
- Disable the account the same day. Do not delete it: tickets and audit records refer to it.
- End their sessions.
- Remove their password vault access and rotate any shared passwords they could see.
Two-factor for client users
Each client has a switch that requires two-factor sign-in for every portal user at that client. There is also a global setting that requires it for all Client Administrators. A user who must use two-factor and has not set it up is sent to the security page until they do. See Security.