Users
The people in your organisation: how each one signs in, which roles they hold, which locations they work at, and whether they are currently allowed in.
Open them at Settings → Administration → Users.
The list
Two views, switched at the top: Members (everyone who belongs to the organisation today) and Removed (people removed from it, who can be restored). A search box ("Search by name or email") filters either as you type. Member columns:
| Column | What it shows |
|---|---|
| Name | Full name, with an Owner badge on the owner. |
| The address, or a dash for a PIN-only person. | |
| Roles | Role names; a dash for the owner, who needs none. |
| Sign-in | Email & password, PIN or Both, plus a PIN set badge when a password user also has a PIN for in-app authorisations, and an Offline badge when the person may sign in offline. |
| Status | Active (green) or Deactivated (amber). |
The Removed view shows name, email, the roles they had, their sign-in method and when they were removed, with a Restore button on each row (with Users.Delete). Removed people cannot be opened; restore them first.
Adding a user
Press New User. Decide the sign-in method first, because it changes which credentials the form asks for.
Sign-in methods
| Method | Asks for | Best for |
|---|---|---|
| Email & password | Email and a temporary password. A PIN is optional. | Owners, managers, bookkeepers, anyone who administers the business or belongs to more than one organisation. |
| PIN | Just a PIN. No email at all. | Counter staff on a shared device. The device remembers the Tenant ID and they type only their PIN. |
| Both | Email, temporary password and a PIN. | People who use a shared device and also sign in on their own device. |
The form, card by card
- Identity: First Name, Last Name
- Both required.
- Identity: Email
- Required for password sign-in ("email is the identity for password sign-in"). Hidden entirely for a PIN-only person. Must be a valid address and not already used by another account on the platform.
- Time Zone
- How dates and times are shown to this person. The first row is the organisation default (inherit). They can change it themselves later on their Profile.
- Sign-in: method chips
- Email & password / PIN / Both, as above.
- Sign-in: Temporary Password
- Shown for the two password methods. At least 8 characters. Share it with the person for their first sign-in.
- Sign-in: PIN
- 4 to 6 digits. Required when the method includes PIN ("this user signs in with it"); optional for password-only people, where it is "used for quick in-app authorisations". PINs are unique within the organisation: if another member already uses the digits you chose, the save is refused and you are asked to choose another. Prefer 6 digits.
- Sign-in: Allow offline sign-in
- A checkbox shown only for the PIN methods. Off by default. Ticked, the person can sign in with their PIN on a device that has no connection, once anyone has signed into that device while online (see Signing in). Consider what it means: the device then holds a check of their PIN, and a PIN is short. Tick it for counter staff who genuinely need to open the device when the connection is down, and untick it when they leave. The server refuses it without a PIN or with the Email & password method, and switches it off by itself when the PIN is removed or the method drops PIN. A PIN set before this feature existed is listed on devices only after the person's next online PIN sign-in, or when you replace the PIN; the checkbox's hint says so. Ticking the box for a new person reaches every device that is online within about five minutes.
- Roles
- Chips for every role. Pick as many as apply; the person gets the union. If no roles exist yet the card says so and points you to Roles. A person without roles can sign in but can do nothing.
- Locations
- Chips for every active location ("none, one or several"). This decides which sites the person may issue receipts at when location selection is on. Inactive locations appear only if already assigned, suffixed "(inactive)".
Press Create User. The server double-checks the same rules and answers with a specific message if something is missing, for example "A PIN is required when the sign-in method includes PIN" or "That PIN is already in use in this organisation — choose a different one".
Editing a user
Open a person from the list. The same cards appear with a few rules that protect their ability to sign in:
- Email is immutable once set. The field is read-only with the hint "Email is the sign-in identity and cannot be changed here."
- A PIN-only person can gain password sign-in. Switch the method to Email & password or Both, and the email field unlocks together with a Temporary Password field. Both are required to complete the switch.
- An existing password is never overwritten here. The form does not offer a password field for someone who already has one. See Passwords below.
- Switching onto PIN sign-in needs a PIN to exist first. The Sign-in method card says whether a PIN is set and, if not, to set one below before switching.
- Allow offline sign-in appears on the Sign-in method card once a PIN is set and the method includes PIN. Changes reach a device at its next connection: an unticked box does not sign anyone out of a device that is offline right now.
The "PIN" card
Shows Set or Not Set. Enter digits and save to Set PIN or Replace PIN. PINs are stored hashed: they can be replaced but never viewed, so if someone forgets theirs you replace it. Remove PIN appears only when the person's method is Email & password; while PIN sign-in depends on it the card explains that you must switch their method first.
Passwords
Deactivate, reactivate, remove and restore
| Action | What happens | Permission |
|---|---|---|
| Deactivate | The person cannot sign in to this organisation until reactivated. Their live sessions end. Nothing is deleted, and if they belong to other organisations those are untouched. A banner on their page says "This user cannot sign in until they are reactivated." | Users.Edit |
| Reactivate | Restores sign-in with the same roles, locations and PIN. | Users.Edit |
| Remove | "Remove this user from the tenant?" Their access here ends immediately, their PIN is freed for someone else, offline sign-in is switched off, and their identity and history (receipts they issued, adjustments they made) are kept so records still show their name. Use Deactivate to block someone temporarily. They move to the Removed view of the list. | Users.Delete |
| Restore | On the Removed view. "Restore name?" brings the person back as an active member with the roles and locations they had, and their history was never gone. Their PIN was freed when they were removed, so if their sign-in method includes PIN the dialog asks for a new one (4 to 6 digits, unique in the organisation); an email & password person signs in straight away. Trying to add a removed person again with New User is refused with a pointer to Restore, because one email is one identity. A person whose identity Greyield Labs has deleted from the platform cannot be restored. | Users.Delete |
The owner
The owner is the person the organisation was created for. On their page the Roles card reads "Not applicable — the owner has every permission automatically", the Locations card says they belong to the whole organisation, and the Deactivate and Remove buttons are absent. The owner always keeps password sign-in as the recovery root, so PIN-only is not offered for them. Ownership cannot be transferred in this release.