Members and invitations

A member is somebody's identity inside one organisation: their roles, their display name, and what they can see. Adding a member is how somebody gets access — it is separate from adding a person to the HR record, which needs no login at all. See Adding people.

Inviting somebody

1. 1

   Send the invitation

   You choose their work role and their HR role at this point. The two are independent — see Roles and access.

2. 2

   They receive a link

   The token is emailed and never returned from the API. It is a bearer credential for a company's HR data, so it reaches only the address that proves control of it.

3. 3

   They accept while signed in

   Accepting is an authenticated action checked against the invited address. A link that joined an organisation simply by being opened could be fired by a mail client prefetching it.

A missing, expired and already-used token all give the same answer, and somebody signed in as a different person is never told which address was invited.

Seats

A seat is a member — somebody with a login. Workers without one are free. The seat is checked both when the invitation is sent and again when it is accepted, because the organisation may have filled its last seat in between, and the count has to be true at the moment it is consumed. See Plans and billing.

Removing access

A suspended membership stops working within about a minute — authority is carried in the session token, and that snapshot is revalidated rather than trusted until the session expires. The same applies to a role change.

Belonging to more than one organisation

A login is global and can hold memberships in several organisations — a consultant working with two clients has one password. The active organisation is chosen in the interface and is validated against the memberships in your session every time: it is caller input and proves nothing on its own.