12. Running it

Team, organisations, permissions, obligations, and the things you hope never to need.

12.1 Your team

Settings → Team. Invite people by email. Three roles:

Roles are enforced throughout, not just in the menu. A member who guesses a settings URL gets nowhere.

12.2 More than one organisation

One login can hold several organisations. Switch between them from the selector at the bottom of the sidebar; each has its own contacts, modules, terminology, plan and team.

Three things make this practical rather than merely possible:

All organisations — a single view of contacts and reminders across every organisation you belong to. Useful first thing in the morning, when the question is "what needs me today" rather than "what needs me in this particular workspace".

My network — import contacts from one of your organisations into another. If you run a consultancy and a charity and the same person appears in both, you do not type them twice.

Isolation is real, not visual. Switching organisations is not a filter. The database itself will not return another organisation's rows, so there is no configuration mistake that can make them bleed into each other.

12.3 Hierarchy and field visibility

For organisations where not everyone should see everything about a person.

Define your own levels — Volunteer, Leader, Pastor; or Junior, Manager, Director — and set which groups of contact fields each level can see.

The use case is pastoral care and anything resembling it, where a small group leader needs to know a member's name and phone but has no business seeing their pastoral notes. It applies equally to a sales floor where reps should not see negotiated margins.

Settings → Hierarchy.

12.4 Consent and the right to be forgotten

Two GDPR obligations, handled properly rather than as a checkbox.

Consent is logged append-only. When someone consents, or withdraws it, that is recorded permanently with a timestamp. You can show what was agreed and when. An editable consent record proves nothing; this one is a real audit trail.

Erasure is real deletion. Chapter 2 covered the two levels: delete is recoverable, erase is permanent. Erase is the right-to-be-forgotten implementation, which is why it makes you type a confirmation phrase including the person's name.

Also relevant: every marketing email carries a one-click unsubscribe, the suppression list is honoured by every sender in the product, and full export is always available.

12.5 Security

Two-factor authentication is available per user, using an authenticator app. Turn it on in your account. If you handle other people's personal data — and you do, that is what a CRM is — turn it on.

The audit log records sensitive operations: merges, permission changes, hierarchy edits, key management. Append-only, browsable by admins at Settings → Audit. It exists to answer "who changed this and when" without anyone having to remember.

Isolation is enforced by the database, not by application code. Described in chapter 2 and mentioned again here because it is the single most important security property of the product: a bug in the application cannot leak another organisation's data, because the rule is enforced one layer below the application.

12.6 Backup and leaving

Settings → Backup. Download everything: every table, plus your configuration. The same export is available over the API, and any conversation can be exported as a transcript on its own.

The phrase on that page is deliberate — leave whenever you want, with everything you own. Full export is a design principle rather than a feature request that got built.

It is also, honestly, a sales argument. Moving into a CRM is frightening because moving out of one usually is. Knowing the exit exists is what makes the entrance safe.

12.7 Your plan

Settings → Billing. Your current plan, what each plan includes, and the upgrade path. Payment goes through Stripe; card details never touch this product.

Plans are per organisation, and so are the invoices. Each organisation in your account has its own plan, its own limits, its own subscription and its own invoice — buying Starter for one does not upgrade the others. That is deliberate: each organisation is its own entity, with its own accounting and its own money, and a separate invoice is what lets you put the expense through the right books.

The upgrade buttons appear only on the free plan. Once an organisation has a subscription, every change — up, down, or cancelling — goes through «Manage subscription» (the Stripe customer portal), which prorates fairly and closes the old subscription properly. Cancelling does not delete anything — you drop to the free plan and your data stays. The portal is also where you update your card and see invoices.

Plans limit users, contacts, automations and sequences. Hitting a limit stops you creating new things; it never breaks what exists.

Launch pricing note: current prices are introductory. If you subscribe now, your price is fixed for as long as you stay on that plan — a future increase applies to new subscribers only. Changing plan yourself, in either direction, moves you to that plan's current price.

12.8 The danger zone

At the bottom of Settings, in red, is the ability to reset or delete the entire organisation. It asks for explicit confirmation because it is exactly as final as it sounds.

12.9 What runs on its own

Five scheduled jobs, so you know what is happening while nobody is logged in:

If something you scheduled has not happened, the delay is at most one cycle from this table.

12.10 The one thing to get right

Everything in this chapter is administration. None of it is why you bought the product.

If you do only one thing consistently, make it the thing in chapter 3: look at the dashboard each morning, deal with the longest silence, log what happened offline, and stop when someone turns red.

That habit is worth more than every setting on this page.