Team and permissions
Invite people
Admin → Members → Invite. Enter their email and pick a role. They get an email with a link that works for 7 days. If the email doesn't arrive, use Copy link and send it yourself, or Resend, which sends a fresh link valid for another 7 days (the old link stops working).
The link opens app.supplysynk.com, where your team signs in from then on. Someone who belongs to more than one business picks which one to work in from the business name at the top of every page.
Roles
Each role can do everything the roles below it can.
| Role | Can |
|---|---|
| Viewer | See products, stock, orders, customers, suppliers and Insights, without cost prices or margins. Change nothing. |
| Staff | Adjust and count stock, transfers, create and fulfil orders, returns, customers. Sees cost prices, margins and stock value at cost. |
| Manager | Products and categories, suppliers, purchase orders, locations. |
| Admin | Team members, API keys, webhooks, Square connection, business settings. |
| Owner | Everything, including the business itself. |
Who sees costs
Staff and above see cost prices and everything worked out from them: margins, profit, stock value at cost and purchase order amounts, on every page, in exports and reports, and through AI assistants acting for them. Viewers see quantities and selling prices only; cost columns and margin figures are simply not shown to them. API keys see costs, so only give keys to software you trust with them.
Activity log
Admin → Activity shows each change: what changed, when, and who (or which key) made it.
Security
Two-step sign-in is required for staff, managers, admins and owners (anyone who can change your data); viewers can turn it on if they like. The first time someone signs in they choose how to get their code:
- Authenticator app (recommended): Google Authenticator, Authy, 1Password and similar. Works without signal, and comes with backup codes for a lost phone.
- Email me a code: a 6-digit code sent each time, valid for 5 minutes.
Signing in with Google still asks for the code. Tick Don't ask again on this device for 30 days on a device only you use. Change method in Settings → Security; people whose role requires it can't turn it off. Lost both phone and backup codes? An owner or admin can remove and re-invite them.
Give each person their own login and the lowest role that lets them do their job; remove people who leave. Their access stops immediately.