Inviting your team and choosing roles

Everyone in your workspace signs in with their own email address and password. Each person has one role, and the role decides what they can see and do.

Before you start

• You need a role that can Manage users and roles. Out of the box, only Administrator can.
• Each colleague's work email address. An address can belong to only one account in a workspace.

Invite a colleague

1. Open Settings (under System in the left-hand menu) → Users and press Invite People.
2. Type their Email. Name (optional) can be left blank; they can change it when they accept.
3. Choose a Role. Staff is chosen for you.
4. Press Send Invitation. Zamilo emails them a link with the subject You are invited to your company on Zamilo.

The link works once, for 72 hours. Your colleague opens it, types Your name, chooses a password (Choose a password, then Confirm the password) and presses Join. They are signed in straight away.

New User creates an account with a first password you set instead. An invitation is better: only your colleague ever knows their password.

Resend or withdraw an invitation

Until someone joins, their invitation is listed on the Users page under Invited, Not Yet Joined, with the role and how long the link lasts (or Expired).

• New Link sends a fresh link that works for another 72 hours. The old link stops working, as it does when you invite the same address again.
• Withdraw cancels the invitation. The link stops working.

The ready-made roles

Every workspace starts with these roles. All of them can open every area of the app until you change that.

Role	What it can do to start with
Administrator	Everything, including users, roles, integrations, settings, exports and backups. It always has everything and cannot be edited.
Quality manager	Create and edit records, void records, close complaints, file incident reports, work the inbox, export data as CSV and read the audit trail. Cannot manage users or settings, approve purchase orders, send invoices to QuickBooks or buy shipping labels.
Staff	Create and edit records, link and reply to email, run syncs, use the AI assistant, adjust stock, send invoices to QuickBooks, fulfil Shopify orders and buy shipping labels. Cannot close complaints, void anything or export data.
Read only	View records and download their forms. Changes nothing.
Associate	Create and edit every record and work the inbox, without voiding, closing, filing or administering, and without seeing when a record was created, edited or closed.

The first four are built in: you can change them, but not delete them. Associate can be changed or deleted.

Change what a role can do

1. Go to Settings → Roles (or press Manage Roles on the Users page).
2. Press the pencil (Edit) beside the role.
3. Tick or clear what it may do. The ticks are grouped under Records, Inbox and systems, Administration, Dates and Areas this role may open; All and None tick a whole group.
4. Press Save Role. Everyone with that role gets the change from their next page.

To make your own, press New Role, fill in Name, Key (it cannot be changed later) and What this role is for, then tick its capabilities. A role you made can be deleted once nobody has it.

An area left unticked disappears from that role's menu and search. Without View records, every list is empty. Someone who manages users without being an Administrator can only hand out roles that do no more than their own.

Edit, deactivate or unlock a user

• Edit (the pencil on their row) changes Email, Full name, Role and Password; press Save User. You cannot change your own role.
• Deactivate is how you remove someone. They are signed out and cannot sign in again, but their name stays on the records and in the audit trail. There is no delete button. Reactivate lets them back in. You cannot deactivate yourself.
• Unlock appears when an account is Locked after too many wrong passwords or codes.
• Reset Two-Step appears for someone who uses two-step sign-in. Use it when their phone is lost; see Lost or new phone.

Require two-step sign-in for everyone

1. Turn on two-step sign-in for yourself first. Zamilo refuses the switch until you have, so it cannot lock you out.
2. Go to Settings → Security. The page is titled Access.
3. In the Two-Step Sign-In box, which shows how many people already use it, tick Require it for everyone (each person sets it up at their next page).
4. Press Save.

Anyone without it is taken to the set-up page at their next click and can do nothing else until it is on. While it is required, nobody can turn their own off.