Management Dashboard — Settings & Permissions

Settings is the organised home for everything that configures your organisation — general details, branding, capture policy, integrations, notifications, and the permissions that govern who can do what. Tiered — Basics for common tasks, Deep dive for permissions, Technical for how it's enforced.

Basics — the Settings sections

Open Settings from the sidebar. It's grouped into sections so each thing has a clear home:

General — organisation name and profile.
Branding — logo and accent colours (these flow into the surveyor app and reports).
Capture policy — on-site GPS requirement and radius, which optional modules (e.g. estimated costs) are on, currency and temperature units, and whether surveyors may create their own reports. Every toggle here applies the moment you change it.
App configuration — which data-collection modules and report sections the field app and report show, the standard legal-disclaimer and scope-of-survey wording, the sign-off declaration, and an optional reference-number prefix. Unlike Capture policy's instant toggles, changes here are staged as a draft: an amber "Unsaved changes" bar appears with Save changes / Discard, and navigating away with unsaved edits prompts you to confirm first.
Integrations — SSO, AI provider key, API & webhooks, your own SMTP server (with an optional one-time fall back to the platform relay if it fails), SFTP servers (Platform plan), and a read-only mail log of every statutory email and resident letter sent from your organisation.
Notifications — what alerts your team receives.
Members / Team — invite colleagues, provision field logins, set role baselines and manage per-member module permissions.
Billing — plan, invoices, statements.
My account — your own sign-in security, plus the Appearance toggle (light / dark / follow system) that applies across the whole portal, for you specifically — not an organisation-wide setting.

Deep dive — roles & permissions

Every member has a role baseline. For a non-owner member, an authorised administrator can then tune each product module from None through Module admin:

System admin — platform-level operations. This is not an organisation role and cannot be granted through the permissions editor.
Owner — the organisation's ultimate account holder: everything org admin has, plus billing/deletion and the ability to transfer ownership.
Org admin — full control of your organisation, including settings, members and billing.
Manager — day-to-day operations.
Coordinator — office staff: raises work orders, schedules visits and keeps case notes, with read-only evidence and dashboards. No exports, deletions, settings or member changes. Free.
Finance — billing and invoices only, plus dashboards. Free.
Viewer — read-only evidence and dashboards. Free.
Surveyor — field-capture baseline for assigned work and surveys.
Operative — works-only baseline for assigned remedial jobs, completion and repair photos. Free seat class. Can be contractor, subcontractor or your own staff.
Contractor — scoped to work granted to their organisation.

To review or change a member, open Members / Team, use that person's Manage action and open Granular permissions. The table shows every product area with its Role baseline, Per-user override, Effective permission and Effective scope. Choose Inherit role to remove an override, or select 0 None, 1 View, 2 Edit or 3 Module admin, then save. For example, a finance member can be explicitly given view access to Evidence while retaining their billing baseline.

An upgrade outside the role baseline is labelled before saving. Surveyor and operative access to evidence, properties, work orders and scheduling always stays limited to assigned records. Explicit access to administrative or other non-record modules can apply across the organisation. Owner permissions are fixed, nobody can change their own permissions, and Module admin never means platform system admin.

Onboarding & offboarding: invite or provision users here, and suspend or remove them with a full audit trail. A surveyor's device can be cut off centrally (remote logout).

Technical — how it's enforced

Server-enforced: callable checks load the member's active status and current role for every privileged request, while Firestore and Storage rules evaluate the same server-written override document. A stale token or hidden button cannot preserve revoked access.
Assignment-aware files: photo paths identify their survey or work order; Storage rules resolve that record before permitting an append-only image upload. Legacy paths that cannot prove assignment reject new writes.
Server-only surfaces: members/roles, audit events, API keys and billing are never client-writable; changes go through audited server logic.
Identity: email, SSO (Entra ID), and tenant username/code logins all map to the same model — see Access control.
Mail log: Settings → Integrations keeps a per-organisation, read-only record of every statutory email and resident letter sent — recipient, status and delivery response — visible to managers, org-admins and owners.

Granular permissions are live in production and nonproduction. Changes apply without waiting for the member to refresh a role claim; a signed-in screen may briefly show a loading state while the effective permission document resolves.

Next: Billing & invoices (in progress), or back to the help index.