Roles and permissions
The two roles a workspace has, Admin and DPO, what each one can see and do, and how each is given.
A workspace has two roles. Admin is the role of everyone you invite. DPO belongs to a Data Protection Officer working with you through a DPO service. The platform checks the role on every action, not only in what it shows you.
The two roles
- Admin can see and use every service, and change the company's legal details, its members and invitations, its billing, the representation mandates it signs and its Privacy Center domains.
- DPO is a Data Protection Officer you've engaged. They can work in Compliance and the Privacy Center, and write to you in the conversation for each of their services. They can't manage the company, its members or its billing.
What each role can do
| Area | Admin | DPO |
|---|---|---|
| Compliance and Privacy Center | Yes | Yes |
| People and Establish | Yes | No |
| Audit log and email outbox | Yes | No |
| Company legal details and primary contact | Yes | No |
| Members, roles and invitations | Yes | No |
| Signing the representation mandate that opens a compliance register | Yes | No |
| Subscribing to a compliance register and managing billing | Yes | No |
| Attaching the Privacy Center's custom domains | Yes | No |
Billing covers every purchase: register subscriptions, upgrading to Pro, paying for an employee's or contractor's service and buying DPO services.
Where a DPO can go
A DPO's menu has Inbox, Compliance, Privacy Center and Reports, beside their own Home, notifications and the conversations for their services. In Compliance they reach only the registers you've opened, and they never see a register's mandate or its billing. They can't open Settings, People, Establish or the Documents list, though they can download the files of the registers they work in. In Reports they can generate any report and download any run, the Audit log export included, so a DPO can read your audit log there even though they can't open it under Settings.
A DPO reaches your workspace only while one of their services with you is active.
See a member's permissions
In Settings › Members, select a member. Their details end with Permissions: the same areas as the table above, ticked for what their role allows. The details also show whether they have Two-factor turned on, and their recent activity.
Changing a role
Roles can't be changed. Colleagues are always invited as Admin, and the DPO role comes only with a paid DPO service or from our team, never from an invitation you send. To take away someone's access, remove them from the workspace.