User Permissions

Control who can access your SeroBook account and exactly what they can see and do. Role-based access control ensures that each team member has the right level of access for their responsibilities, keeping your data secure while enabling efficient collaboration.

Role-Based Access Control

SeroBook uses a role-based access control (RBAC) system to manage permissions. Each user is assigned a role that determines which features and data they can access. Roles are hierarchical, meaning higher roles include all permissions of lower roles plus additional capabilities.

The RBAC system follows the principle of least privilege: each user should have only the minimum access necessary to perform their job. This reduces the risk of accidental data changes or unauthorized access.

Available Roles

SeroBook provides five built-in roles, each designed for a specific level of responsibility:

Owner

The account owner has unrestricted access to all features and data. This role is automatically assigned to the person who created the SeroBook account. There is exactly one Owner per account.

• Full access to all settings, including billing and subscription management
• Can transfer ownership to another user
• Can delete the account
• Can manage all team members and their roles
• Cannot be removed from the account by other users

Admin

Admins have nearly the same access as the Owner, with a few restrictions. This role is ideal for business partners or senior managers who need full operational control.

• Full access to bookings, customers, analytics, and all operational features
• Can manage team members (invite, remove, change roles up to Admin level)
• Can modify business settings, integrations, and email templates
• Cannot manage billing or subscription (Owner only)
• Cannot delete the account or transfer ownership

Manager

Managers can oversee day-to-day operations and manage staff, but cannot modify business-level settings. This role is suited for shift leaders, department heads, or senior staff.

• Full access to bookings: create, edit, cancel, and manage all bookings
• Full access to customer records: view, edit, and manage customer profiles
• Access to analytics and reports
• Can manage Staff and Viewer role users (invite, remove)
• Cannot modify business settings, integrations, or billing
• Cannot access API keys or webhook configurations

Staff

Staff members can manage their own bookings and view customer information, but have limited access to business-wide data. This is the most common role for front-line employees.

• Can view and manage bookings assigned to them
• Can create new bookings and assign them to themselves
• Can view customer profiles associated with their bookings
• Can view their own performance metrics
• Cannot view other staff members' bookings or performance data
• Cannot access business-wide analytics or reports
• Cannot manage team members or modify any settings

Viewer

Viewers have read-only access to bookings and schedules. This role is useful for accountants, consultants, or team members who need to see data but should never modify it.

• Can view all bookings and the schedule calendar (read-only)
• Can view customer profiles (read-only)
• Can view analytics and reports (read-only)
• Cannot create, edit, or delete any records
• Cannot access settings or manage team members

Custom Permissions

For businesses that need more granular control, Pro plans include the ability to create custom permission sets that go beyond the built-in roles.

Creating a Custom Permission Set

1. Navigate to Settings > Team > Permissions
2. Click Create Custom Role
3. Give the role a descriptive name (e.g., "Senior Receptionist" or "Marketing Staff")
4. Toggle individual permissions on or off across categories:
   • Bookings – View, create, edit, delete, manage all vs. own only
   • Customers – View, create, edit, delete, export
   • Analytics – View dashboard, view reports, export data
   • Settings – Services, schedule, email templates, integrations
   • Team – View members, invite, remove, change roles
   • Financial – View payments, process refunds, view revenue reports
5. Click Save Role

Custom roles appear alongside the built-in roles when assigning team members. You can edit or delete custom roles at any time. Deleting a custom role will reassign affected users to the Staff role by default.

Inviting Team Members

Add new users to your SeroBook account by sending them an email invitation:

1. Go to Settings > Team > Members
2. Click Invite Team Member
3. Enter the person's email address
4. Select the role you want to assign
5. Optionally add a personal message to the invitation email
6. Click Send Invitation

The invitee receives an email with a link to accept the invitation and set up their account. Invitation links expire after 7 days. If the link expires, you can resend the invitation from the team management page.

Pending Invitations

Pending invitations are listed at the bottom of the team members page. You can:

• Resend – Send another invitation email if the original was lost
• Cancel – Revoke the invitation before it's accepted
• Change Role – Modify the assigned role before the invitation is accepted

Managing Access

Once team members are on your account, you can manage their access from Settings > Team > Members.

Changing Roles

Click the role dropdown next to any team member to change their role. The change takes effect immediately. Only users with a higher role can change another user's role (e.g., an Admin can change a Manager's role, but a Manager cannot change an Admin's role).

Removing Team Members

To remove someone from your account:

1. Click the three-dot menu next to their name
2. Select Remove from Team
3. Confirm the removal

When a team member is removed:

• Their access is revoked immediately – all active sessions are terminated
• Bookings they created or are assigned to remain in the system
• Their name appears as "Former Team Member" on historical records
• Their audit log entries are preserved for accountability

Temporarily Disabling Access

Instead of removing a team member entirely, you can temporarily disable their access by clicking Suspend. Suspended users cannot log in or access any features, but their account and history are preserved. Re-enable their access at any time by clicking Reactivate.

Audit Log

The audit log provides a complete record of every significant action taken in your SeroBook account. This is essential for security monitoring, compliance, and accountability.

What's Logged

• Authentication events – Login, logout, failed login attempts, password changes, 2FA changes
• Booking actions – Created, edited, cancelled, status changes, assignment changes
• Customer actions – Created, edited, deleted, data exported, data erasure
• Settings changes – Any modification to business settings, integrations, or team configuration
• Financial actions – Payments processed, refunds issued, price overrides
• Team management – Invitations sent, roles changed, members removed

Viewing the Audit Log

Access the audit log at Settings > Security > Audit Log. Each entry shows:

• The action that was performed
• Who performed it (user name and email)
• When it occurred (date and time with timezone)
• The IP address of the user
• Additional context (e.g., which booking was modified, what fields changed)

You can filter the log by user, action type, date range, or search for specific entries. The audit log is retained for 12 months on all plans and can be exported as a CSV file.

Two-Factor Authentication

Two-factor authentication (2FA) adds a critical second layer of security to your team's accounts. We strongly recommend enabling it for all users, especially those with Admin or Owner roles.

Enabling 2FA for Your Account

1. Go to Settings > Security > Two-Factor Authentication
2. Click Enable 2FA
3. Open your authenticator app (Google Authenticator, Authy, 1Password, Microsoft Authenticator)
4. Scan the QR code displayed on screen
5. Enter the 6-digit verification code from your authenticator app
6. Save your one-time recovery codes in a secure location (e.g., password manager or printed backup)

Requiring 2FA for Your Team

Account Owners and Admins can enforce 2FA for all team members:

1. Navigate to Settings > Security > Team Security
2. Toggle Require Two-Factor Authentication
3. Choose the enforcement policy:
   • All users – Everyone must enable 2FA
   • Admins and above – Only Admin and Owner roles require 2FA
   • Managers and above – Manager, Admin, and Owner roles require 2FA
4. Set a grace period (e.g., 7 days) for existing team members to set up 2FA before being locked out

Permission Best Practices

Follow these best practices to maintain a secure and well-organized team:

• Audit roles quarterly – Review team members and their roles every three months. Remove anyone who no longer needs access and adjust roles as responsibilities change.
• Use the lowest necessary role – Start with a lower role and upgrade if the person needs more access. Avoid giving everyone Admin access.
• Require 2FA for sensitive roles – At minimum, enforce 2FA for Owner and Admin roles. Ideally, require it for all users.
• Remove access immediately for departing staff – When someone leaves your organization, remove their SeroBook access the same day.
• Don't share accounts – Each team member should have their own account for proper audit tracking. Sharing credentials makes it impossible to know who performed specific actions.
• Review the audit log regularly – Establish a routine for checking the audit log, especially after onboarding new team members.

Next Steps

Now that you understand user permissions:

• Review the full security overview
• Learn about privacy and GDPR compliance
• Understand API rate limits and access controls