Teams, roles and access
One rule holds this page together: brands belong to the organization, people hold roles against them. When anyone on your team creates a business profile, it lands in the organization – visible to the people whose role covers it, billed to the owner's plan, and listed in the admin portal with who created it and when. Nobody's work lives in a personal silo.
The two layers of access
Access is decided in two layers, and it helps to keep them apart:
- Organization role – what kind of teammate someone is. Set on the Team page when you invite them, changeable any time.
- Client access – which brands a scoped teammate is assigned to. Set per member on the Team page ("Update role and client access").
Management roles see everything, so client access only matters for the work roles below.
Roles at a glance
| Role | Sees | Can do |
|---|---|---|
| Owner | Every brand | Everything – including billing, the plan, and buying credits |
| Admin | Every brand | Manage clients and the team, set per-brand credit budgets. No billing |
| Manager | Every brand | Operate every client and manage the team. No budgets, no billing |
| Creative Director | Assigned brands | Oversee creative output on their assignments |
| Strategist | Assigned brands | Plan campaigns and strategy on their assignments |
| Editor | Assigned brands | Create and edit content on their assignments |
| Member | Assigned brands | Work their assigned clients |
| Viewer | Assigned brands | Read-only |
| Support | The Helpdesk | A confined seat – lives in Helpdesk, nothing else; finds a customer only by their exact e-mail, phone or customer number, and is never offered a link out of the Helpdesk (no Open in Customers) |
| Data Engineer | The Data hub | A confined seat – lives in Data, nothing else |
What "sees" means. Everything made for a brand – campaigns, e-mails, social posts, the calendar, surveys, audiences, competitor analyses, AI CRO reports, library items – is visible to everyone who can open that brand. A link a colleague shares opens for you if the brand is yours to open. Only the person who made something can change or delete it, and when they delete it, it is gone for everyone.
"Assigned brands" means the brands ticked for that member under client access – plus any brand the member created themselves, while they are on the team. A scoped teammate with one assignment sees exactly one brand in their switcher, on Home, and everywhere else. The platform enforces this at the database and the API alike; it is not cosmetic.
Who can do what
Create a business profile – any teammate except the confined seats. A brand is only ever created in an organization its creator is on the team of; nobody can add a brand, a project or a task to someone else's organization or to a brand they cannot open, and the page says so in one sentence if they try. The new brand automatically belongs to the organization: the owner and managers see it immediately, it appears in the admin portal's Business Profiles list with "Added by" and the date, and it uses one of the plan's brand slots.
Brand slots – brands are counted against the owner's plan, no matter who creates them. How many the pool holds depends on that plan; your plan page carries the number. When the pool is full, every add-brand button routes to an upgrade instead of a creation flow that would fail.
Delete a business profile – an Owner, or the teammate who created it. Admins and Managers edit every brand but delete only the ones they created themselves. The Danger zone sits at the bottom of the profile – in the admin portal under Business Profiles, and in the app under Brand settings → Profile – and asks you to type the brand's name before Delete forever. Deleting stops the brand's journeys and removes its audiences, autonomous team, surveys, site messages and settings for everyone. Its library – every item made for it, whoever made it – moves to another brand of the organization or goes with it; you choose. You can't delete the last brand you can open, and the deletion is listed in the admin portal's Audit Logs.
Invite and manage the team – Owner, Admin, and Manager. Invites are sent by email; the invitee joins by signing up with the invited address. Team seats are counted against the owner's plan the same way brands are, and the plan page carries that number too.
Everyone in the organization sees the roster – who is on the team and in which role – so nobody has to ask who a colleague is. Managing it is the three roles above.
The account of record. One account holds the organization: the plan, the wallet, and the final say. A teammate invited as Owner runs the organization alongside them – the same team, brands and budgets – with two exceptions that exist so the account nobody can be locked out of stays that way. Nobody can change or remove the account of record's own seat, and nobody changes their own role. The account of record does both.
Set per-brand credit budgets – Owner and Admin only. Budgets draw on the owner's credit balance: the platform refuses any allocation the owner's balance cannot cover, and tells you the real numbers when it does. Managers and work roles can see budgets, not set them.
Billing, plan changes, buying credits – the Owner only. There is one wallet per organization – the owner's – and every teammate's work draws on it. Admins and Managers can read the billing summary in the admin portal without being able to change anything. Even though the owner's balance pays, the admin portal's Audit Logs, Team and Usage pages name who spent each credit: the teammate, or "AI teammate" for work your AI teammates and support employee did. The Team page counts the last 30 days. In Audit Logs, spending from before 7 September 2026 on the shared balance shows as "Not recorded", because who spent it was not kept then.
Hold a Helpdesk ticket – anyone on the organization's team who can open the conversation's brand and takes customer support tickets for it, whatever their role (the account of record too). A Data Engineer seat never: it cannot open the Helpdesk. The Helpdesk's assignee lists offer exactly those people for each conversation's brand, the Helpdesk checks every assignment itself, and a teammate who leaves keeps their name on the tickets they worked (never their e-mail address). Someone who leaves the team, or can no longer open a brand, stops holding its open tickets: they go back to Unassigned.
Who takes customer support tickets is set per person and per brand, in the Customer support section of Add a team member and Edit team member in the admin portal's Team page: one tickbox, Takes customer support tickets, then either Every brand they can open, including brands added later or Only these brands. A role only sets where it starts: a new Support seat starts ticked for the brands it is given, everyone else starts unticked, and anyone but a Data Engineer seat can be ticked, viewers and owners included. Ticking someone gives them no access they did not already have. Owners, admins and managers can set it for anyone on the team, fellow owners and the account of record included (rows whose role they cannot change carry a Customer support menu item for this alone), and can set their own there too. Everyone else starts or stops taking a brand's tickets with one click on the Helpdesk (Team is in the admin portal, which is for owners, admins and managers). Whoever is changed by someone else gets a notification saying who changed what; several changes before they read it make one notification that says where they stand now. Each person's row in Team says what they take ("Takes tickets · All brands", or the brands), and nothing when they take none. Connecting a brand's support inbox or switching its site chat on ticks the person who did it for that brand, and only them. Who can see and work a brand's tickets, mailbox and saved replies is decided by the brand alone: having connected the brand's support inbox or social account, or being on the team of whoever did, gives no access to a brand you cannot open.
Who counts in helpdesk reports sits right under it, for owners, admins and managers: Counted in helpdesk reports, one tickbox per brand, for the brands the person takes tickets on and any brand they are already left out of. Untick a brand to leave them out of that brand's helpdesk Reporting, for example an owner who holds tickets that teammates really answer: their tickets leave Who handled it and their replies stop counting as the team's, while every customer number stays. It is the same choice as Leave out of reports in Reporting, so a change in either place shows in the other. Each person's row in Team says where they are left out ("Left out of helpdesk reports · Goldcrest"), and nothing when they count everywhere.
Who may hire AI teammates is set per person and per brand too, in the AI teammates section of Edit team member in the admin portal's Team page: one tickbox, May hire AI teammates, then either Every brand they can open, including brands added later or Only these brands. Hiring an AI teammate spends the organization's credits, so only owners, admins and managers set it, for anyone on the team and for themselves (rows whose role they cannot change carry an AI teammates menu item for this alone); nobody else can tick themselves. The account of record always may hire, because it pays. The owners, admins and managers on the team when this setting arrived start ticked for every brand; everyone else, and anyone who joins or is promoted later, starts unticked until an administrator ticks them. Ticking someone opens no brand they could not open already, and a Support or Data Engineer seat cannot be ticked: it cannot open Agents. Whoever is changed by someone else gets a notification saying who changed what. Each person's row in Team says where they may hire ("Hires AI teammates · All brands", or the brands), and nothing when they may not.
Journeys – Owner, Admin, and Manager can operate any journey; scoped teammates can operate journeys on their assigned brands. A journey always runs as the organization – sending domains, segments and audiences are the organization's, not the operator's.
Recommended setups
Solo founder. You are the Owner; hire no one until the work demands it. Everything above collapses into one person and stays out of your way.
In-house team. The budget holder is the Owner. Give your head of marketing Admin – they can run clients, the team, and budgets without touching the plan. Everyone producing work gets a work role (Editor, Strategist, Creative Director) with all brands assigned if your company runs one estate.
Agency. The principal is the Owner. Operations leads get Admin, account leads get Manager. Every account team member gets a work role scoped to exactly their clients – a designer on two accounts sees two brands and nothing else. When a client relationship ends, remove the assignment and their access ends with it; when a teammate leaves, Team first hands what they hold to someone who stays (see Why can't I remove someone yet? below), then removes them, and every brand stays with the organization. They no longer open its brands, not even the ones they created: they cannot see, change or delete them, the brand is no longer the one their account works in, and the brands stay in the organization for everyone still on the team, with their projects and tasks.
One caution: Admin and Manager see every brand by design. If a teammate should ever see less than everything, give them a work role and assignments – don't hand out Admin because the invite form suggests it first.
Sharing a sending identity between brands
A verified sending domain, email provider, SMS sender or WhatsApp number belongs to one brand. When another brand of yours needs the same one, you don't set it up twice:
- Before the second brand has one, its setup dialog (Connections → the email, SMS or WhatsApp card) opens with Use an existing setup: the verified identities on your other brands, one click to link. For email you pick this brand's own from name and address on the shared domain. Nothing to verify, nothing to add to DNS.
- From the brand that already has one, the same card shows Also use this … for… with the brands that don't have one yet, and a line saying which brands already use it.
Two things to know. Only people who can open both brands can link them, and a brand that already has a verified identity is never overwritten. And a shared identity shares its sending reputation: a bad send from one brand affects deliverability for every brand on that domain or number. Marketing and service (transactional) identities stay separate.
Connections to other platforms – HubSpot, Shopify, ad accounts – are still connected per brand.
A connection belongs to its brand, not to the person who connected it. Everyone who can open the brand sees it under Connections and can disconnect it, so a teammate never has to connect an account a colleague already connected. In the Organization view, Connections lists every brand's connections, each labelled with its brand. A setup that must belong to one brand – the support inbox, for instance – asks you to pick the brand first when your organization has more than one.
Common questions
A teammate created a brand – whose is it? The organization's. It counts against the owner's brand slots, the owner and admins can budget it, and it shows in the admin portal with the creator's name and date.
Why does my teammate see brands they weren't assigned? Their role is Owner, Admin, or Manager – those see everything. Scoping applies to the work roles.
Can I limit what an Admin sees? No – Admin means the whole estate. Use Manager if the difference you need is budgets, or a work role with assignments if the difference is which brands.
We removed someone – what happens to their work? Their brands and content belong to the organization and remain exactly where they were. Only their access ends: the brands they were given one by one go with them, and a brand they created stays with the organization without them. So do the projects and tasks on those brands, including the ones they made. Any open or pending Helpdesk tickets they held go back to Unassigned, each with a line saying "Returned to Unassigned: their name can no longer open this brand"; resolved tickets keep their name.
Why can't I remove someone yet? Because they still hold something one of your brands runs on, and it would stop or be lost with them. Remove from team lists each thing, what would happen to it, and keeps Remove switched off until nothing is left to move:
- A website and its site chat. The chat on a site stops as soon as the person who added the site leaves, and the site's tracking then depends on their own plan.
- A journey they built. It runs as them.
- An audience they built. A live audience refreshes as them, so it would stop refreshing, and the journeys that use it would keep reading its last members.
- A sender or sending domain they connected (SMS, e-mail, WhatsApp, push). The whole brand sends with it, but it is kept under their account.
- A block list they keep for the brand.
- A brand they created. It is kept under their account; if that account were ever deleted, the brand and everything in it would go with it.
Each of these has Move to with the teammates who can open that brand (a Support or Data engineer seat is never offered), and Move everything that can move to does them all at once. Owners, Admins and Managers move them; changing who a brand belongs to is for an Owner, and a brand only goes to an Owner, since whoever holds a brand can delete it. An audience only goes to someone who can change that brand.
Two things cannot be moved, because they are the person's own. Team lists them so you know, but they never hold Remove back:
- A connection made with their own login (Instagram, Facebook, Google Ads, Stripe and the rest). It goes with their account. Someone who stays connects their own on the Connections page.
- An API token they created. It acts as them, so it stops working once they leave. Someone who stays creates a new token under API keys and the integration switches to it.
When nothing is left to move, Remove works as before. The same rule holds if someone asks for their account to be deleted: it waits until what your brands run on has been moved. Your own seat as the account of record never has a list: you stay on the team whatever happens.
Changing someone's role or brands. Edit team member saves the role and the brands together: if any part cannot be saved, nothing changes and Team says why. When the change means they can no longer open a brand, their open Helpdesk tickets on it go back to Unassigned, and Team says how many.