Team Members

Team Members (Staff) manages firm users, roles, and business access — owners and admins see all clients; members see assigned businesses only. Invite staff, customize their menus, toggle API access, and track invitation delivery from Settings > Staff. People who belong directly to a single client business are managed under Members in Settings > Business.

Key capabilities

• Three staff roles: owner, admin, member (changed inline via a dropdown)
• Owners and admins see all businesses; members are scoped to assigned businesses
• Manage access modal to assign specific businesses to a member (direct or via team)
• Per-user API access checkbox (turning it off blocks that user's API keys)
• Customize menu per member: restrict which sidebar sections they see, firm-wide or for one client
• Invite one or many people by email with optional first/last name, a role (Admin or Member), and, for members, the businesses they can reach
• Pending Invitations panel with live email delivery badges
• Delivery states: not sent, sent, delivered, opened, bounced, spam-reported
• Resend invitations (with a short cooldown, auto-lifted after a bounce or complaint)
• Cancel pending invitations and an "Expired" flag for stale invites
• Remove a member to revoke firm access immediately (you cannot remove yourself here)
• Downgrading a role asks for confirmation, and the only owner cannot demote themselves

How it works

Role sets the default reach; members are then narrowed to specific businesses directly or through team membership.

flowchart TD
  role{"Staff role"}
  role -->|"Owner / Admin"| all["All businesses"]
  role -->|"Member"| assigned["Assigned businesses only"]
  assigned --> direct["Direct assignment"]
  assigned --> viaTeam["Via team membership"]
  direct --> access["Effective access"]
  viaTeam --> access

How to use it

1. Open Settings > Staff.
2. Click Invite Member, enter one or more emails (comma or new line), optional names and a personal message, and choose Admin or Member. For a member, pick the businesses they can reach or All firm businesses.
3. Set each person's Role from the inline dropdown: Owner, Admin, or Member.
4. For a member, click Manage access to check the businesses they should reach — team memberships also grant access automatically.
5. Click Customize menu on a member's row to limit their sidebar: choose Firm-wide menu for every client, or pick one client to override it.
6. Use the API access checkbox to allow or block that person's API keys.
7. In Pending Invitations, watch the delivery badge; use Resend (refresh icon) or Cancel (X) as needed.
8. Click the trash icon to remove a member and revoke their access at once.

Pro tips

• Use the Member role for bookkeepers who should only see their assigned clients — not the whole firm.
• Watch for Bounced or Spam reported badges: the resend cooldown is automatically lifted so you can retry or fix the address immediately.
• Client portal access is managed separately under Settings > Clients — staff roles never grant portal access and vice versa.
• Uncheck API access for staff who shouldn't script against DayZero; their existing keys stop working until re-enabled.
• Use Customize menu to keep a member out of workspaces and sections they don't need; owners and admins are never filtered.
• Removing a member is immediate and firm-wide; reassign their teams/clients first if continuity matters.

In-depth guide

Roles & permissions

Member access assignment

The Manage access modal controls which businesses a member can reach:

• Lists every firm business with a checkbox for direct assignment.
• Businesses reached via a team are marked "(via team)" and shown as granted even if the direct box is unchecked.
• Select all / Deselect all speeds up setup; Save writes the direct assignments.
• Team-based access is managed separately on the Teams page.

Customize menu

For members, Customize menu opens a two-step editor. A Firm-wide menu applies to every client unless you override it for a single client. A member reached only through a team has no per-client menu; use the firm-wide menu or assign them to the client directly. The row shows Custom (firm-wide) when one is set. The menu controls what sections the person can open, not which clients they can reach, and sections left off are blocked, not just hidden. Owners and admins always see All sections, and Settings always stays available.

API access checkbox

Each staff row has an API access checkbox. It is on by default and owners and admins control it per user. Turning it off disables that user's API keys until re-enabled. Approval for API access itself still comes from DayZero; see Developers.

Invitation delivery states

Resend and expiry

Resends have a one-hour cooldown per invitation to avoid spamming recipients. The cooldown is automatically bypassed when an invite has bounced or been marked as spam. Invitations expire after a period; expired ones show an Expired flag.

Audit implications

Role changes, removals, and invitation actions are sensitive account events. Use the Audit Log to see who changed a role or removed a member — useful for SOC reviews and offboarding.

Practical notes

• Only members get the Manage access control; owners/admins always show "All businesses."
• Removing a member revokes access immediately but does not delete the businesses or teams they touched.