Staff and roles

Every person who signs in to your shop has one of two roles: tenant admin or tenant employee. The difference is not a matter of hidden menu items — an employee is refused entry to every administrative screen at the routing layer, before any page loads. This page covers what each role reaches, how to manage the people in your shop, and why signing in on a new device can sign you out of an old one.

The two roles in your shop

There is a third role, super admin, but it is not yours to assign. It belongs to the platform team who operate GOLD PRO across all shops, and it signs in through a separate entrance. See Core concepts for how the boundary between your shop and the platform is drawn.

What employees can and cannot reach

An employee has the whole daily workflow. They can run valuations, manage the customer book, capture KYC, track EMIs, and read the dashboard and analytics. Nothing about the core job is gated.

What they do not get is the Admin section. If an employee follows a link or types a URL under Admin, they are redirected to the dashboard rather than shown an error, and the page itself refuses them a second time on the server.

The practical shape of this: employees produce the work, admins configure the business around it. An employee can price a valuation at whatever the gold rate per gram currently is, but cannot change that rate. They can dispatch a report to a bank branch, but cannot add the branch.

Adding an employee

Go to Admin > Employees and open New Employee. There are three fields.

Use Generate to produce a 14-character password that omits the characters people misread — capital I and O, lowercase l, zero and one — then the copy button to put it on your clipboard. The field is deliberately shown in plain text, since you have to relay it to the person.

Every account you create is an employee. There is no role picker, and a tenant admin cannot promote someone to admin or create a second admin account. If your shop needs another admin, raise a ticket — see Support. There is no limit on how many employees you may create.

The Temporary Password label describes your intent, not an enforced rule. A new employee is never prompted or forced to change the password you set, and can keep using it indefinitely. If it matters to you, tell them to change it themselves under Admin > Personalization, and confirm that they did.

Disabling versus deleting

The Actions column offers both, and they are not the same.

Disable flips the account inactive. The person keeps their row, their history and their name on every valuation they appraised, but is refused at login with "Account disabled", and any session they currently hold stops working on its next request. This is what you want when someone leaves, goes on long leave, or is under question. It is reversible — activate them and they carry on.

Delete removes the account row permanently. It is not a soft delete and there is no undo.

Prefer disabling. It is reversible, it revokes access as immediately, and it keeps your activity logs legible — a log line that names a user who no longer exists is harder to read a year later.

Passwords

Anyone can change their own password under Admin > Personalization (employees reach the same profile screen from their own account menu). It asks for the current password, requires at least 8 characters, and refuses a new password identical to the old one.

As an admin you can overwrite an employee's password from Edit Employee using the New Password (optional) field. This is the only reset mechanism — there is no separate reset button and no reset email.

Overwriting an employee's password does not sign them out and does not notify them. Any session they already hold keeps working. If you are resetting a password because someone should no longer have access, disable the account instead — that is the action that actually revokes them.

Changing your own login email is different again: it signs you out immediately, and you sign back in with the new address.

One session per device type

Each account holds exactly one browser session and one mobile app session at a time. The two do not conflict, so you can be signed in on the shop computer and on your phone at once.

Signing in a second browser takes over the browser slot, and the first browser stops working — its next action bounces it to the login page with a note saying it was signed in elsewhere. The same rule applies independently to the app: a second phone evicts the first phone but leaves your browser alone. Signing out explicitly releases your own slot without touching the other device.

There is no screen listing your active devices, and no way to remotely sign out a particular one. To end someone's access, disable their account.

This is the reason to give every person their own login. If two people share one account, each sign-in silently kicks the other out, and every action lands in your activity logs under the same name — so you cannot tell who did what.

Sign-in lockout

Five consecutive failed sign-in attempts for the same email address lock that address for 15 minutes. The message tells the person how many minutes are left. A successful sign-in clears the counter, so the lockout only ever fires on five failures in a row.

The lock is tied to the email address, not to a device, so moving to another computer does not clear it. Waiting out the window does, and so does a correct password once the window passes. Failed attempts and lockouts are both recorded in Admin > Activity Logs.