Team, roles and audit
Give people exactly the software they need. And nothing else.
A cleaner sees their jobs. A coordinator sees their buildings. An accountant sees the books. None of that is a tidier menu: it is enforced underneath the application, in the database, on every single query.
Twenty-four roles
Named jobs, not permission checkboxes.
Most software hands you a grid of permissions and lets you invent a role that half works. Stay N Host ships the roles a rental operation actually has, each already carrying the right access: cleaner, maintenance, coordinator, point of contact, accountant, owner, investor, and the rest.
Pick the role, scope the seat to the properties it covers, send the invite. The sidebar that person sees is generated from what they may do, so nobody spends their day looking at screens that will refuse them.
You do not have to take that on trust. An admin can open the access matrix in the product and read every role against every capability, which is the answer to "what can a coordinator actually see" without asking us. A seat and its operational roles are separate grants, and a role carried by a team counts exactly as a role held directly.
Choosing a role →
The ceiling
Two things a custom role can never be given.
Moving money
No custom role may be granted a money-moving permission. Not by an administrator, not by an owner, not by anyone. Separation of duties that can be edited away is not separation of duties.
Releasing a door code
The door-code permission belongs to one seat, the point of contact. It is the same permission an automation rule needs to execute, so revoking the seat closes both doors at once.
The dual gate →Reaching around the scope
Per-property scoping is a database policy, not a filter in a page. A scoped seat that guesses at another property's link gets nothing back, because the rows are not visible to that session.
Crossing a workspace
Every table is scoped to its workspace and every query goes through the same guard. Cross-workspace reads are impossible by construction, and there are tests whose only job is to keep proving it.
How isolation is enforced →The trail
Every change names its author. Including the robots.
There is no such thing as an untracked state change here. Each one writes an immutable audit row carrying what changed, when, and who did it. Automated actions record the system as the actor along with the identifier of the rule that authorized them, so a message sent at 3am points at a rule you wrote rather than at nobody.
When something needs a second pair of eyes, park it. Approvals are a queue, the policy is configurable per workspace, and parked items surface on Today rather than waiting to be discovered.
Reading the audit trail →What an audit row carries
- The entity and the exact fields that changed, before and after.
- The actor: a named person, or the system plus the rule identifier.
- The workspace, so a row can never be read from another one.
- The time, at the precision the event happened, not the precision it was noticed.
Audit rows are append-only. Nothing in the product edits or deletes them.
"When somebody leaves, the guest history stays with the business."
FAQ
Team and permission questions
How many roles are there?
Twenty-four built-in roles, from cleaner and maintenance through coordinator, accountant and point of contact, up to owner and investor seats. Each one is a named set of permissions, and the full matrix of who may do what is published in the documentation rather than being something you discover by trying.
Can I build my own role?
Yes, with a ceiling. Custom roles compose permissions you already hold, but two things can never be granted to one: moving money and releasing a door code. That ceiling exists so that separation of duties cannot be edited away by whoever is currently the administrator.
Can a seat be limited to certain properties?
Yes. A seat can be scoped to specific properties, and the scoping is enforced in the database with row-level security rather than by hiding menu items. A coordinator for two buildings cannot read the third by changing a URL.
What is written to the audit trail?
Every state change, without exception, along with who caused it. Automated actions record actor "system" plus the identifier of the rule that authorized them, so an action taken at 3am by an agent names the rule you wrote rather than appearing anonymous.
Can I require a second person to approve something?
Yes. Sensitive actions can be parked for approval and worked from an approvals queue, and the approval policy is configurable per workspace. Parked items appear on the Today dashboard so they do not sit unnoticed.
What happens when someone leaves?
Remove the seat. Conversations, notes, history and evidence stay with the business because they were never attached to a personal phone or a personal inbox in the first place. That is the whole reason the shared inbox exists.
Try the whole platform free for 14 days
Full Growth-plan access. No credit card. Your data stays yours.
Start free trial