Users & roles
Who works in your shop and what each one can do. Invite new staff by email — they'll get a link to set up their password. Five roles available (admin, manager, cashier, clerk, viewer) — each one comes with a sensible default set of permissions, and you can override per person if needed. Last admin can't be removed.
Enter their email and pick a role. They'll get a sign-in link valid for 7 days. Trims whitespace, accepts mixed-case emails, suggests corrections in real time.
The sign-in link is valid for 7 days. The new user shows up in Current staff below with a ⏳ Pending sign-in badge until they accept.
Current staff
Manager PIN required to change any role. Click Change role on a row to open the confirmation. Disabling a user uses the same flow and is reversible from the Activity history.
Pending invitations
Roles & what each can do
Read-only reference. This page shows you what each role is allowed to do by default. To actually assign a role to a person, head to the Staff tab and click Change role… next to their name (Manager PIN required).
Every role change is logged in the Audit tab with timestamp, actor, and the before/after value. The last admin cannot be demoted or disabled — there's always at least one person who can change things back.
Recent activity
Every sensitive action is logged. Role changes, invites sent, sales voided, refunds processed, price changes, drawer closes — all here with who did it and when. Read-only. Audit entries can't be edited or deleted, ever.