◑User accounts and roles

Four, from top to bottom:

• Owner — may do everything, including what nobody else may do: assign the Owner role and change other owners. There is usually exactly one.
• Administrator — administration and operations: user accounts, mailboxes, legal, deliverability, system status, blocked addresses.
• Team member — the daily work: contacts, companies, opportunities, campaigns, tasks, phone.
• Read only — view and search, but change nothing and send nothing. Intended for people who should follow along without intervening — for example in accounts or in management.

The role decides which areas appear in the menu and which actions are allowed — not which data exists. A team member sees the same contacts as an administrator.

With “Read only” it can happen that a button is visible and the attempt is then rejected. The rule sits on the server, not in the interface — rejection is reliable, hiding is not applied everywhere.

Under Administration → User accounts. There are two ways, and the first is the right one:

1. Invite. You enter the email address and role; the person receives a setup link and chooses their password themselves. Nobody types a password for someone else.
2. Create an account with a password, if no email can go out. The password is valid immediately; do not pass it on by email, and ask the person to change it straight away.

In both cases: at least 12 characters. Shorter ones are rejected with the message that the password needs at least 12 characters.

Only an owner can assign the Owner role.

Once your plan’s number of user accounts has been reached, no further account can be created — the message says so and shows how to book more. Open invitations do not take up a place yet.

In the row of the account. The new password needs at least 12 characters; if it is shorter, it is rejected.

The better way, where it is open to you: send a new setup link instead of setting a password. Then once again only one person knows it.

Two restrictions:

• Only an owner sets an owner’s password.
• There is no success message. When the field closes, it has worked.

What is not possible in any case: having an existing password displayed. It is not stored in plain text anywhere.

In the row of the account. The change takes effect as soon as the person reloads the page or signs in again.

Two rules restrict this:

• Only an owner assigns the Owner role, and only an owner changes an existing owner.
• The last active owner cannot be downgraded, locked or deleted. The attempt is rejected with a message. This is the safeguard against locking yourself out of your own system.

Be sparing with administration rights. Not out of mistrust, but because that is where the buttons are that do something irreversible: disconnect mailboxes, permanently delete attachments, lift blocks.

Deleting asks twice. After that:

The person’s tasks and histories are kept, but lose their assignment. So no work is lost — afterwards you simply can no longer see who it had been.

If that assignment matters (for example as evidence), it is better to only switch the account off rather than delete it.

In this order:

1. Switch off the account — immediately, on the last working day. This matters more than everything else.
2. Check the mailbox: did sending go through her address? Then switch running campaigns to another sender mailbox, otherwise replies go nowhere.
3. Redistribute follow-ups and tasks — otherwise they do not fall due, they simply stop being noticed by anyone.
4. Release the telephony profile.

Only after that, and only if there is a reason, delete the account.

In the Access log. It records who, when, where and with what result — and can be filtered by area, person and period. The list of areas grows by itself; new modules appear automatically.

There are two deliberate gaps you should know about:

• Reading is not logged. A fresh instance rightly shows little here.
• The content of a change is not stored — it would be a second, unprotected copy of all personal data.

Technically yes — an account is an account. In practice you should ask yourself two questions first:

• Does the person really need the whole system? An external service provider who is to write a campaign does not need any contact data — the template can also be agreed as a file.
• Is the processing covered? An outsider with access to personal data is a processor; that requires a contract.

Once both are settled: create the account as a Caller, tidy up the areas via the navigation, and switch it off immediately when the collaboration ends.

The invitation. The principle is stated next to the field: nobody types a password for someone else.

The difference is not convenience but accountability: a password that two people knew makes every assignment in the access log open to challenge.

Where you do have to set a password — for example because no outgoing mail has been set up yet — do not pass it on by email, and ask the person to change it straight away.

If no email goes out, Aurora Hive Sales says so honestly: “Not sent.” — and gives you the setup link back so that you can pass it on yourself. It is long; send it as a link, not for typing in.

The administration areas: user accounts, mailboxes, legal, deliverability, system status, blocked addresses — and, where present, customer management.

The data is not restricted: a team member sees the same contacts, companies, opportunities and campaigns as an administrator. If you want to restrict access to data, you cannot achieve it through roles — that requires separate installations.

Read only goes one step further: viewing and searching yes, changing and sending no. But there too: the same data.

Switch off in almost all cases: the account can no longer get in, and the assignment of tasks and histories is kept.

Delete only if there is a reason — then the person’s tasks and histories lose their assignment, and this cannot be undone.

For the case “a colleague is leaving”, switching the account off on the last working day is the right and sufficient action.

At least two, at most a few.

At least two, because a single admin on holiday is a problem — a mailbox is stuck, an account needs creating, and nobody can get at it.

At most a few, because these areas hold the buttons that do irreversible things: permanently delete attachments, touch instances, overwrite data.

With a specific question in mind — otherwise it is just a long list.

Filter by area, person and period. Typical questions it answers: who last touched this record? Who started the expensive run? When did the export happen?

And know its limits: reading is not logged, and the content of a change is not stored — you see that something changed and who changed it, not what had been there before.

Enlarge

As long as it serves a purpose, and no longer. A log without end is itself a data protection problem: over years it shows who worked when, and so lends itself to performance monitoring, which it was never meant for.

Two rules are enough in everyday use:

• Limit how far back it goes. Six months cover the normal case. Anything with a longer after-effect — an incident, a subject access request, a legal dispute — is secured individually and with a stated reason.
• Do not use it to assess staff. As soon as there is a works council, any evaluation by person is subject to co-determination (§ 87 (1) no. 6 of the German Works Constitution Act, BetrVG) and inadmissible without its consent.

If there is a works council in the company, the question of who may evaluate the log and when belongs in a works agreement (Betriebsvereinbarung) — before the first evaluation, not after the first complaint.

Four things, and all four have the same reason: they concern the question of who will control the system in future.

• Assign the Owner role.
• Change, lock or delete another owner.
• Set an owner’s password.
• See the vendor areas, if your installation has any. They stay hidden even when someone has put together their own menu.

On top of that comes the safeguard in the other direction: the last active owner cannot be downgraded, locked or deleted. A system without an owner would be a system into which nobody could let anyone in any more.

How many owners make sense: one, at most two. Everything else belongs in the Administrator role. If the only person with owner rights is on holiday and nobody can create an account, that is a good reason for a second one.

It is the invitation: a link through which a person finishes setting up their account themselves and chooses their password — at least 12 characters.

What you should know about it:

• It is valid for 14 days. After that it no longer leads anywhere.
• It is valid for exactly this installation. A link from another installation is rejected.
• A new link can be created at any time — without the old one having to expire first. Both are then valid until the deadline passes or the account has been set up.
• A password that is too short does not use up the link. You can try again straight away.

If the link has expired or does not belong here, the page says so explicitly: this setup link is no longer valid, and the person should ask their contact for a new one.

For the very first account of a new installation, the setup link is the only way in, and the first account is always an Owner. Without a link, the setup page only shows the note that an invitation is needed — so nobody who guesses the address can register first.