Inviting team members

Team access is managed in Setup → User Management, which sits alongside Settings & Branding and API & Integrations. This guide covers inviting somebody, choosing their role, the security settings worth changing on day one, and what to do when an invitation does not arrive.

Before you start

• You need an admin-level account — adding users and changing roles is not available to every role.
• Have the person's work email. Invitations are tied to the address, so a personal address now means a migration later.
• Check your seat allowance first: Free 1 seat, Professional 3, Enterprise and Agency unlimited. Extra Professional seats are £50/month each. See what each plan includes.

1. Send the invitation

User Management → Add User. Enter the Email Address, pick a Role, set an Expiry for the invitation, and choose whether to Send welcome email with login instructions. There is a Custom Welcome Message field if the invitation needs context — useful when you are inviting a client rather than a colleague.

Sent invitations are listed under the Invitations tab with when they were sent and when they expire, so you can see at a glance who has not accepted.

2. Choose the right role

The permission matrix in Roles & Permissions is per module, and the roles are more granular than a simple admin/editor/viewer split: Super Admin, Event Admin, Event Manager, Finance Manager, Marketing Manager, Sponsor Manager, Production Manager, Judge, Check-In and Viewer, plus Sponsor Rep.

Pick the narrowest role that lets somebody do their job. Finance Manager for the person chasing invoices, Check-In for the agency staff on the door for one night, Viewer for a client who wants to watch progress. + Create Custom Role exists if none of them fit, and + Create Team groups people who should be treated the same way.

3. Set the security baseline once

The Security tab is where the account-wide rules live, and the defaults are worth reviewing before you invite anybody:

• 2FA Requirement and Allowed 2FA Methods, with optional backup codes and re-verification after 30 days.
• Password rules: Minimum Length, expiry, uppercase, number, special character, and preventing reuse of the last five.
• Session Timeout, Max Login Attempts, Lockout Duration and concurrent sessions.
• Require 2FA for new admin roles, forced logout on password change, and admin notification on a suspicious login.
• IP allowlisting, with ranges one per line, and an option to exempt super admins.

Two more are easy to miss and both save cleanup later: Auto-Deactivate After Inactivity, and Check-In Staff Access Window, which limits door staff to the period around the event rather than leaving them with a live login all year.

4. Check it worked

The All Users table shows Name, Email, Role, Last Login, Status and whether 2FA is on. The Activity Log records Timestamp, User, Action, Detail and IP Address, with settings for retention, log level, and whether failed logins, permission changes and data exports are logged. If you are ever asked who changed something, that is the screen.

Judges are not team members

Do not invite judges here. They are added on the Judging Panel and reach the product through the Scoring Portal with a magic link, seeing only the categories assigned to them. Giving a judge a workspace login gives them far more than they need. See Judging workflows.

Common problems

• The invitation never arrived. Check the Invitations tab for the expiry, then spam filters. Corporate filters are the usual culprit; resend to a different address if you need to move quickly.
• The invitation expired. Send a new one; expiry is set per invitation and there is a default under Settings.
• "Seat limit reached." You are at your plan's seat count. Deactivate somebody who has left, or add seats — see Billing, upgrades, and invoices.
• Somebody can see more than they should. Change the role rather than asking them not to look, and check Roles & Permissions to see what that role actually grants per module.
• Somebody has left. Deactivate rather than delete, so the Activity Log entries still attribute to a real person.