Users & roles
Invite staff, assign roles and control permissions at a fine-grained level
Through user management you invite your team and control, via roles, who may do what.
Invite a user
Open the user list
Navigate to Administration → Users.
Send an invitation
Click Invite user. Enter a name and email and choose a role. The person receives an invitation email with a link to set a password.
Recommend 2FA
Recommend that your staff enable two-factor authentication.
Manage roles
SimpliServ ships default roles like Admin, Sales, Workshop, Accounting. You can create your own roles under Administration → Roles.
Permissions (RBAC)
Per role you assign rights per module (read, create, edit, delete). Examples:
- Workshop staff see orders but no invoice totals
- Accounting may commit invoices but not delete contacts
Time-clock permissions
These permissions control who may use and manage the time clock:
| Permission | What it allows |
|---|---|
attendance.view | See your own clocked times + clocking status |
attendance.clock | Clock in/out yourself + toggle a break (implies attendance.view) |
attendance.admin | Edit others' clocked times, reset PINs, manage terminals (implies attendance.view + attendance.bypass_gate) |
attendance.bypass_gate | The "Please clock in" lock screen is skipped — admins can use the app without being clocked in themselves |
The Admin role inherits attendance.bypass_gate automatically via attendance.admin. If you need the bypass for non-admins (e.g. management): attach the permission to the role explicitly.
Audit log
All security-relevant actions (login, role change) are documented in the activity log and stored tamper-proof.
Deactivate a user
Instead of deleting staff, deactivate them. Historical data (e.g. an invoice's creator) is preserved this way – a login is no longer possible.
Related topics
- Security settings — enforce 2FA organisation-wide for your whole team
- Activity log — trace who changed which object and when
- API access & external apps — grant staff API keys and MCP access
- 2FA — how your staff set up two-factor authentication
- Time clock — record clock-in and clock-out, controlled via the
attendance.*permissions
How is this guide?