Administrator settings are not one long form but ten tabs split by subject. Branding and theme live in one place, outgoing mail in another, monitoring thresholds in a third, so changing one setting does not mean walking past ten unrelated fields. The split also matches responsibility: the person who touches the SMTP password is rarely the person who sets the SLA target. Permissions are a separate axis — who sees what, and who receives which notification, is decided here.
The tabs fall into four groups: the workspace itself (general and working hours, Collector centre), identity (authentication, portal invitations), email (sending, inbound rules, notification templates) and operations (monitoring, automation, system and network). Each tab saves on its own; editing one does not disturb another.
A fixed product rule: being an administrator does not mean receiving every ticket email. Notification subscription is per user, never per role, so promoting someone never fills their inbox. It removes the classic complaint — “I made them an admin and now they get 200 messages a day”.
Roles and operation permissions are defined here, and the restriction is not just a hidden menu — it is enforced in the API and query layer. A technical role never sees sale price, cost or margin. A sales role sees detailed technical solutions only with an explicit grant. Staff accounts and operation permissions are managed from the Users screen, not from a settings tab.
The directory connection (AD/LDAP), login lockout and the password reset flow sit in one place. Failed login attempts are recorded; once a threshold is crossed the account and the source IP are locked for a period, and password reset runs through a single-use link. Directory integration exists but is not mature: field installs hit DNS resolution and private CA certificate validation problems, and that work is still open. The product runs on local accounts without a directory.
The second factor is set up with Google or Microsoft Authenticator and belongs to the person. It is not mandatory for the first administrator during setup — it can be enabled later from the My Account screen. An invited user, however, cannot reach any data before setting their own password and Authenticator on first login.
Outgoing mail (SMTP and the report queue), inbound rules (which message becomes a ticket, under which condition) and notification templates (the text that actually goes out) are deliberately separate, because the three change at different times and by different people. The portal invitations tab is for opening a portal area for a customer or department and inviting that portal's user.
The monitoring tab defines device type groups and thresholds, so a switch and a storage unit are not measured against the same limit. The automation tab holds scheduled work: ticket closure, period reports and monitoring notifications. A threshold change shows up in the alert list; an automation setting shows up in the queue.
The general tab keeps the logo, brand name, working days and SLA targets. There are three themes: the default warm one, ocean (blue) and graphite. Organisation mode opens blue by default, but the theme is a workspace setting and can be changed.
Operating system and kernel version, Docker/Compose version, pending security updates, whether a reboot is required and the last maintenance date are all read from this screen. It reports status and offers a safe maintenance checklist; the web application does not run arbitrary shell commands or package updates as root. That is a deliberate boundary rather than a gap: whoever reaches the panel should not thereby own the server. Operating system work happens on a separate management surface or over SSH.
Nothing is missing; that is the rule. Being an administrator does not mean receiving every ticket email, because notification subscription is per user. Which notifications that person receives has to be chosen separately.
The authentication tab has an AD/LDAP connection, but the honest answer is that this area is not mature yet. Field installs hit DNS resolution and private CA certificate validation problems. We suggest testing the directory environment together before rollout; running on local accounts is always possible.
Not for the first administrator during setup — it can be enabled afterwards from My Account. Invited users, though, cannot reach any data until they finish the password and Authenticator setup on first login. The second factor uses Google or Microsoft Authenticator.
No. The technical role does not see sale price, cost or margin fields, and the sales role does not see detailed technical solutions without an explicit grant. The restriction is not only a hidden menu; it is enforced in the API and query layer.
No. The system and network tab shows versions, pending security updates, whether a reboot is needed and the last maintenance date, and it offers a checklist for the maintenance steps. The web application does not run package updates or arbitrary shell commands as root — operating system work happens on a separate management surface or over SSH.
Settings are stored per subject in their own tables, and database upgrades are designed to be re-runnable, backward compatible and to preserve existing data. The design principle: a missing helper column must not drop the whole panel to an error page, and main data failures are handled separately from helper modules. A backup is still taken before every upgrade.
IT administrators running the installation, workspace owners, and the team leads responsible for who gets to see what.
Let us open a workspace for you and try it with your own customers and devices. We will guide you through setup and data migration.
