Users and roles | Made with Pepper

For: owners managing team access. Where: Settings > Users, or go to /settings/users.

User list

The user list shows all team members with their name, email, role badge, and status. Pending invitations appear below the member list.

Inviting a user

Click Invite member to open the invitation form. Review the address, role and any guest limits before sending.

Field	Required	Description
Email	Yes	The email address to invite
Role	Yes	Choose Admin, Employee, Accountant or a custom role

The invited person receives an email with a link to set their password and activate their account. Invitation emails send during the request. They need no queue worker. See Add users and assign roles.

Pending invitations

Invitations that users have not accepted appear in the Pending invitations section with:

Email address
Assigned role
Date sent
Actions: Resend (send the invitation again) or Revoke (cancel the invitation after you confirm)

Editing a user

Owners and admins can edit non-owner accounts. Use Your profile in the account menu to change your own name, email or password. Admins cannot edit the owner. You cannot change your own role through user editing.

For a non-owner account, you can edit:

Name
Email
Role assignment

Roles

Role	Access level
Owner	Full access to documents, settings, users, backups, updates and the audit log. Only the owner can transfer ownership. Only one user can have this role
Admin	Manage operational settings, non-owner accounts, backups, updates and the audit log. Cannot use owner-only security, module, provider or connection controls
Employee	Can create and edit their own documents and shared customers and items. Customer history and search show their own documents. Cannot see settings, reports, customer financial summaries or exports
Accountant	Read-only access to all financial data. Can view and export invoices, customers, and reports. Cannot edit

See Roles and permissions for the detailed permission matrix.

Deactivating a user

Click the deactivate action on a user. Deactivated users cannot log in. Made with Pepper keeps their data and audit history. You can reactivate them later. Their previous sessions and remembered logins remain invalid; they must sign in again. You cannot deactivate yourself or the owner.

For a departure with open work, use Offboard on the user's account. Review the successor and record counts before you confirm. Follow People and teams for the handover steps and access safeguards.

Deleting a user

Delete a non-owner user to remove their account and revoke access. You cannot delete yourself or the owner. Made with Pepper keeps their audit log entries (deleting a user does not cascade to the audit log).

Transferring ownership

The owner can transfer the owner role to an active admin from the user management page. The former owner becomes an admin. Both people must sign in again. This requires confirmation. Only one user can be the owner at a time.

Session expiry

Changing a password, resetting a password or changing a role expires the affected user’s other sessions and remembered logins. A password change from Profile keeps the current session. A password reset does not reactivate an inactive account.

Permissions

Only the Owner and Admin roles can access Settings > Users. Employees and accountants cannot manage accounts. Their permitted People directory is separate from account administration.

Custom roles and guests

Open Settings > Roles to create a custom role. Choose a unique name and at least one permitted action. Built-in roles cannot be edited.

Custom roles cannot grant installation settings or account administration. Changing a role signs out its holders and stops their existing external credentials. Delete a custom role only after its users and pending invitations have another role.

An invitation can enable Invite as a guest. Guests use an Accountant, Employee or custom role, with a separate scope. They cannot become Owner or Admin.

Choose permitted modules. To restrict records, also choose named customers or engagements. Without named records, the selected modules are available within the role's normal permissions. A guest flag alone does not limit access to one customer.

See Roles and permissions before granting access.