← All documentation · Running the company
Team, roles and permissions
Web app2 min readUpdated
Owners manage the company and managers run the work, with narrower roles for people who only estimate or only read; changing a role or deactivating someone revokes their access immediately.
The roles
- Owner — manages the company: settings, billing, the team, the payment account.
- Manager — runs the work: quotes, schedules, customers, payments.
- Estimator — quotes and the customers behind them.
- Read-only — can look, cannot change.
Some abilities are gated on the role rather than simply hidden — overriding a quote's final price is the clearest example, and what it records is described in Pricing a quote.
Changing a role or deactivating someone takes effect immediately, on sessions that are already open. Somebody who left this morning is not still signed in this afternoon.
Locations
On the Business plan, people are assigned to locations, and what they can see follows: the schedule, the search box and the reports show one location's work at a time, with an "all my locations" view for people who work across several. Search never becomes a way around this — it only ever returns what your role and your locations already cover.
Company isolation
Every query is scoped to your company. Another tenant's data is not merely off-limits; as far as the system is concerned it does not exist.
How people sign in
Passwords and Google, Microsoft or Facebook accounts are credentials on the same account and can be mixed freely. Disconnecting one that has been compromised signs out every other session at the same time. See Creating your account and signing in.
Sign-in sessions live on the server, in secure cookies that browser scripts cannot read. To keep recent work available offline, the browser may also keep a small working set on the device. That offline information is separated by signed-in user, company and location and cannot be used to sign in; on a shared computer, sign out and clear BlastoClean's stored site data when you also want to remove the device copy. Sign-in is rate limited, passwords are hashed with per-user salts, and a bot check appears only after repeated failures — a normal sign-in stays one click.
The activity trail
A company-wide record of who did what, when, to which record — pageable and filterable. It is there for the week you have to reconstruct, and it exports with the rest of your data. See Exporting your data.