Access levels and extra rights

In the client area, each contact has an access level for your company, and it decides which pages they see. An accountant doesn't need nginx logs, and a sysadmin doesn't necessarily need the invoices. Your own level is shown under My profile › Account, below the profile form.

The three levels

Part of the client area	Technical	Administrative	Full
Services, Docker, monitoring, logs, alerts	yes	no	yes
Security: blocks, DNS, firewall rules	yes	no	yes
Invoices, orders, documents	no	yes	yes
Renewals, reports, support	yes	yes	yes
Team, API tokens, access rules, activity	no	no	yes

• Technical (services, monitoring, security): for the people who run your machines and sites. Amounts don't appear in renewals or reports.
• Administrative (invoices, documents): for accounting and purchasing. They see amounts, pay invoices and place orders.
• Full (everything, and the team): all of the above, plus running your company's client area.

The same table appears on the Team page, tab Contacts, under "What each access level can see".

Extra rights

On top of technical (or full) access, some rights are given one by one, because they let someone act on your machines:

• Monit actions: start, stop and restart the Monit checks of your machines;
• VM power actions: start, shut down or restart your virtual machines, and the other actions that depend on it (on-demand backups, snapshots…);
• VM firewall: change your VMs' firewall rules;
• DevOps: run on your machines the operations we publish for your company;
• Docker actions: start, stop and restart the Docker containers of your machines;
• Docker console: open a console in those containers.

The DevOps and Docker rights are only given by our team: ask us for them.

An administrative contact can't hold these rights: moving a contact to administrative removes them.

Roles

Our team can also give you roles: sets of permissions finer than the three levels, granted for all your services or for some of them only. A role may, for instance, let someone reboot one given machine without touching the others, or manage the DNS of a single domain name.

• Roles add to your access level: you keep what it gives you, and gain what the role allows, on the services and domains it names.
• A contact may also have roles only, with no level. My profile › Account then says “by roles” instead of the level, and the menu only shows the pages its roles open.
• Buttons follow your permissions one by one: with a role that lets you add and change DNS records without deleting them, Add a record and Edit show, not Delete. The same goes for a VM's power actions, Monit actions, snapshots, the firewall, probes, channels and alert rules.
• In an account opened by roles from the start, each service delivered gives the account's holder full access to that service by itself; it is lost when the service ends. In an account moved from levels to roles, this is not automatic: ask us for it.

When your account moves from levels to roles

Our team can turn your company's access levels into roles. Nothing changes in what each person can do:

• each contact gets a role named “Ancien niveau : …” (former level), holding exactly what their level and extra rights gave them;
• My profile › Account says “by roles” instead of the level;
• in Team, the level column shows By roles, and the “What each access level can see” table is no longer shown;
• new contacts are invited without a level, then given their roles.

You can then refine: give a colleague a role on one service only, or ask us to replace a former level with more precise roles.

Give a colleague a role

Roles are given by our team and, in your company, by the contacts who manage the team.

1. Open Team. The Roles block lists each contact's roles.
2. Under the contact, click Give a role and choose the role.
3. Tick the services and domains it applies to (each list shows how many are ticked, and a search once it is long), then click Give the role. For a role you hold on everything, you can also choose All services and domains, or All except… to leave a few out: a service delivered later is then included.

Take back removes a role; the contact loses what it gave at their next page.

Good to know:

• You can only give a role you hold yourself, and only on the services and domains you hold it on.
• The roles of the account holder are managed by our team.
• In an account by roles, a contact you invite starts with no access: give them their roles right after the invitation. Access levels are no longer offered there.

See what a contact can do

Under each contact of the Roles block, What they can do unfolds the list of their permissions, access level and roles together: by section (services, virtual machines, monitoring, domains, billing, account), each possible action and what it applies to — “on everything”, or the services and domains named. It is the surest way to check an access before handing it to a contractor.

If the contact has rights on services or domains you do not see yourself, the list says so without naming them.

Who grants access

Our team opens the first accesses. After that, the contacts we've allowed to invite run the team themselves, never giving more than their own rights.

A person who already has an access with another client company (a contractor working for several companies, for example) can't be added from your area: the invitation answers « This person already has an access with another company ». Ask our team, who adds them for you. The activity log only shows what was done in your area, never what your contacts do for another company.

Limit a contact to some services

By default a contact sees all your company's services. If our team opened the feature for your account, you can limit a contact to a few services: a contractor who should only see the server it looks after, for example.

1. Open Team. Under the contact's rights, the line reads All services.
2. Click Choose…, select Only the services ticked below, then tick the services.
3. Click Save. The line then reads « Limited to … services ».

The limited contact now lists those services only. Everything attached to another service is closed to it: its page, power, firewall, backups, console, through its API tokens too.

Good to know:

• Only a contact with full access allowed to invite sets these limits, and never on another contact with full access (who always sees everything).
• What is about a service follows the limit: ongoing problems, incidents, maintenances and availability only show what concerns its services.
• Pages about the whole company (alert channels, DNS, invoices, support) still follow its access level.
• A limited contact no longer invites new contacts.
• A service added later isn't visible to a limited contact until you tick it.

Good to know

• A page outside your level shows "This page is not part of your access". Ask a colleague with full access, or our team.
• If you work for several companies, you have one level per company. The company switcher in the top bar lets you move between them, and your rights follow.
• A level change applies on the contact's next page.