How access actually works

Every account walled off. Every action signed.

Agencies, their teams, and their clients all run through one platform. Here's exactly how access is scoped by role, what gets logged, and where the walls sit between organizations.

Three things keeping one account out of another's business.

01

Six roles, and nobody sees past their own job

A Super Admin sees the whole account. A Sub Admin runs their own clients, never another Sub Admin's. An Inventory Manager's access stops at domains. An Accountant's stops at invoices. A Client, and any Client Staff logins under them, see only their own orders, with vendor pricing kept out of view entirely.

Super AdminFull access
Sub Admin31 permissions
Inventory Manager7 permissions
Accountant8 permissions
Client20 permissions
Client Staff9 permissions
02

Nothing happens without a name on it

Every order update and status change gets logged to the person who actually made it. A new domain goes through an approval step before anyone can quote it, with a full trail on that listing. Bob acts inside whatever permissions are already logged in, and pauses first on anything irreversible.

ORD-0412 marked LiveVerified automatically
Anchor text updated on ORD-0413Sub Admin
New client added - Bright Path RetailSuper Admin
Invoice INV-0114 sentAccountant
03

One client's account doesn't know another exists

Isolation isn't a setting someone has to remember to flip on. A client dashboard is structurally incapable of showing another client's orders, invoices, or which vendor a placement actually came from.

Bright Path Retail
3 orders
Modern Lifestyle Co.
1 order

Who sees what, role by role.

The question a client or a partner will ask you first, answered per login.

RoleSeesKept out of

Super Admin

Sees: The whole account.

Kept out of: Nothing inside their own organization.

Sub Admin

Sees: Their own book of clients.

Kept out of: Every other Sub Admin's clients.

Inventory Manager

Sees: Domains, and keeping them current.

Kept out of: Billing. Their access stops at domains.

Accountant

Sees: Invoices.

Kept out of: Anything past invoices.

Client

Sees: Their own orders and invoices.

Kept out of: Vendor pricing, your other clients, and how a placement was sourced.

Client Staff

Sees: The same narrow view as the client they sit under.

Kept out of: Everything the client is kept out of.

What comes up before someone signs.

No. Each Sub Admin manages their own book of clients, and that book isn't visible to other Sub Admins.

Only their own orders and invoices - never your vendor pricing, never your other clients, and never how a placement was actually sourced.

No. Bob acts inside whatever permissions your role already has, and asks for confirmation before anything irreversible - it never operates with a wider set of permissions than you do.

Not formalized yet. If you need documentation now for a vendor review, contact us and we'll work through it directly.

Order updates and status changes are logged to the person who made them, and a new domain carries its approval trail on the listing. Links marked live by the automatic check are logged as verified automatically.

This page does not document offboarding yet, so we will not guess at it here. What is documented: the changes that person made were logged under their name. For how logins are removed, ask us and we will answer for your setup.

Got a security questionnaire to get through?

Send it our way and we'll work through it with you directly.

Contact us