Team & Permissions
Add team members, assign roles and permissions, manage seats, and set up the approval chain.
Users & Permissions (/my/company/team) is where company admins manage the people in the account. The platform's permission model enables a clean separation of duties: writers write, reviewers review, publishers publish.
Seats & plans
The page header shows your seat usage (users in use vs. allowed by your plan). Only writing users count toward the seat contingent — read-only users are free of charge. When seats are exhausted, the Add user button is disabled and links to the upgrade.
Adding a team member
Add user opens the member dialog:
Account details
Name, salutation, job title, and the e-mail address — it doubles as the login. Optionally set an initial password.
Status and roles
Set the account Active and tick the roles the member should have. Each role's tooltip lists the actions it grants; select all / clear all helpers and a seat-consequence hint keep you oriented.
Settings
Choose the member's approving user (who reviews their references), interface language, and timezone. Address, contact data, and a portrait photo are optional.
Existing members are edited through the same dialog — including password resets, deactivation, and portrait upload.
With location-based reviewer assignment enabled, editing a member additionally offers a Reviewer responsibilities section: assign in one pass at which locations this member reviews which reference groups — handy when onboarding a new controller. Company-wide responsibilities are shown there read-only; they are maintained on the reference group itself.
The invitation message
As soon as the new member is saved, a pre-filled invitation message opens: recipient, subject, and a welcome text with the personal link for setting a password are already filled in. Adapt the text (add a personal greeting, explain what the colleague should do first) and click Send. The message reaches the new member by e-mail and in their inbox.
If you close the message without sending it, nothing is sent. You can send the invitation any time later with the Send invitation action (paper-plane icon) on the member's card, for example when a colleague lost the first mail.
The invitation text is yours to edit. A sentence on why the colleague gets access and who to ask makes the first sign-in far more likely than a generic system mail.
Join requests
People can also ask to join your team themselves: when they register as an employee of your company, or request it later from their dashboard. Once they have confirmed their e-mail address, everyone allowed to add users (Create user permission) is notified by e-mail, and the dashboard shows the number of pending requests.
Pending requests appear in a Join requests section on the team page, with name, e-mail address, request date, and the applicant's optional message (e.g. their department):
- Approve adds the person to your team with the default read permissions. Adjust their roles afterwards like for any other member. Approval needs a free seat in your plan, just like Add user.
- Reject declines the request. You can add an optional note, which is sent to the applicant by e-mail.
The applicant is informed by e-mail either way. After an approval they work in your company's context from their next sign-in.
Roles & permissions
Roles bundle fine-grained permissions. The role legend on the team page describes each role; the underlying permissions include:
| Permission | Allows |
|---|---|
| Create / edit / delete reference | Working on references in the Reference Manager |
| Reference review | Reviewing and confirming suggested references (Controller) |
| Publish reference profile | Setting references to Approved and publicly visible (Publisher) |
| Create client / product / partner | Creating the related entities, incl. inline creation in the reference form |
| Create / edit / delete user | Team management |
| Edit / delete locations, company media | The respective profile managers |
| Edit company settings | Master data, company settings, branch settings, single sign-on, the AI gateway |
The UI adapts automatically: members never see buttons they can't use.
A typical setup
- Reference managers — create/edit references (no publish permission): they can take content to Suggested.
- Reviewers/Controllers — additionally reference review: they confirm content quality.
- Publishers — publish reference profile: the final go-live decision.
- Company admins — everything, including team, settings, and billing.
- Read-only members — colleagues in sales who search, compare, export, and share references — free of charge.
Single sign-on
Companies using Microsoft Entra ID can enable single sign-on so members log in with their organization account. Company admins set it up themselves under Company settings → Single Sign-On — including automatic accounts and default roles for new colleagues. See Single Sign-On.
Security: require two-factor authentication
Company admins (anyone with Edit company settings) can make two-factor authentication mandatory for all members — sidebar → Security (/my/company/settings/security), toggle Require two-factor authentication.
Once enabled:
- Members who already use 2FA sign in as usual.
- Members without 2FA are guided through the authenticator setup at their next sign-in — before they reach the workspace.
- Nobody can disable their 2FA while the requirement is active.
Members who sign in through Microsoft single sign-on are not affected — for SSO accounts, multi-factor policies are enforced by your organization in Microsoft Entra ID.
Announce the change to your team before switching it on: everyone needs a smartphone with an authenticator app (e.g. Microsoft or Google Authenticator) at their next sign-in.
Filtering & housekeeping
With more than a handful of members, the toolbar offers name search, a role filter, and sorting. Deactivate members who leave (their content stays); deleting an account is permanent.