Roles, users & security

Watch the lesson: Invite a teammate and give them a role (1:58).

Who can see what, who approved what, and how to prove it later.

The roles that ship

Twelve, seeded for every new business whatever plan it is on. The last four are for modules the Manufacturing plan carries, and which a plan from Business up can add on its own: Procurement & supplier workspace for a Buyer, Bills of materials, planning & production for a Production Planner, and Logistics & Fleet for a Fleet Controller or a Driver. Without the plan or the add-on they are there and have nothing to open. All of them are a starting point; every one can be copied and changed.

Role	Intended for
Owner	The person who owns the business. Full access, including billing and deleting the account.
Admin	Day-to-day administration including user management.
Accountant	Full financial access — posting, reporting, reconciliation — without user administration.
Sales	Quotes, invoices, customers and the full sales CRM. Read-only on reports and the dashboard, so a rep can see how the numbers stand without changing any; no access to payroll or banking.
Viewer	Read-only across what they are given.
Payroll Manager	Employees, runs, payslips and leave. No access to sales or banking.
Tax Practitioner	All six permissions on SARS and on Reports — view, create, edit, delete, approve and export — so they can prepare returns and post adjusting journals through the ledger. View and export on invoices, expenses, banking and payroll; view on contacts and the dashboard.
External Auditor	Read and export, with no ability to change anything.
Buyer	Requisitions, purchase orders, suppliers and the three-way match. Manufacturing, or the procurement add-on.
Production Planner	Bills of materials, material planning and production. Sees despatch, does not dispatch.
Fleet Controller	Trips, vehicles, drivers and proof of delivery. Manufacturing, or the logistics add-on.
Driver	The day's trip and recording proof of delivery, and nothing else — not contacts, not documents, not the price of what is on the vehicle. Most drivers need no login at all and work from an app link; this is for one who signs in. Manufacturing, or the logistics add-on.

The last four are not added to businesses that already exist.

Buyer, Production Planner, Fleet Controller and Driver are seeded for businesses registered after they were added, and are not backfilled: a new system role appearing in an established account is a permission change nobody asked for. If you want them, build them in the role builder — the permissions are all there.

The permission matrix

Each role holds up to six permissions on each of the modules:

view — open the module and read its data
create — add new records
edit — change existing records
delete — remove or void records
approve — sign off items in a queue, such as expense claims or a payroll run
export — take the data out as PDF, Excel or CSV

The matrix view shows modules down the side and roles across the top, so you can see the whole policy at once. If none of the twelve fit, build a custom role and tick the permissions yourself.

Not every module offers all six.

A dashboard has nothing to create, and nothing in a contact, an invoice, an entity or a role definition waits for a second person — so those boxes are not offered rather than offered and ignored. Every checkbox you can tick is one some part of Ledgr actually reads.

Approve is separate from edit on purpose.

Someone who can capture an expense should not automatically be able to approve it. Keeping the two apart is the cheapest internal control you have.

Inviting a user

Roles & Users → Invite user
Email address, name and role
Ledgr creates the account with a temporary password and shows it to you once, on the screen that confirms the user. It also emails it to them, with a link to sign in; the screen says whether that email went out. If it did not, give them the password yourself, somewhere only they can read it. They change it under Settings → Security on their first sign-in.
Entity access
On a multi-company account the dialog lists your entities. Tick the ones they may work in, or tick none for every entity. Access is per entity, not all-or-nothing — and each entity can also give them a different role.
Check the seat count
Seats are limited by plan — 1 on Free, 3 on Starter, 10 on Business, 25 on Professional, 1 on Compliance (the practitioner's own seat), and Unlimited users on Enterprise, Unlimited users on Manufacturing and Unlimited users on Practice. An invitation over the limit is refused and says so; a Extra seats pack from Settings → Billing & Plan raises it.

Customers, employees, suppliers and drivers do not take a seat — they get a portal link instead of an account.

Sessions and policies

Sessions — every active session per user, with a revoke button for a lost or stolen laptop
Policies — session timeout, password rules, lockout after failed attempts, and how long the audit log is kept: seven years by default, the Companies Act period, and never less than the five years the Tax Administration Act requires

Revoking a session or changing a user's role takes effect on their next request, not at their next login.

Two-factor authentication

Adoption is shown as a ring, so you can see at a glance who has not switched it on. Ledgr supports any authenticator app — the six-digit code kind.

Recovery codes

Enrolling produces ten single-use recovery codes, displayed once. Ledgr keeps only a fingerprint of each, so there is no screen, no export and no support request that can ever show them to you again. Save them somewhere that is not the phone holding the authenticator.

A recovery code is entered in the same box as the six-digit code at sign-in — Ledgr tells them apart by their shape, so there is no second screen to find while you are locked out.

If somebody loses their phone

An owner or administrator can reset another person's two-factor from their user record. It needs the roles edit permission and an owner or admin role, and:

You cannot reset your own — that would make two-factor optional for whoever holds the permission.
If you have two-factor on yourself, you are asked for your own code first.
The affected person's sessions are revoked and they are emailed about it. Ledgr reports whether that email actually went, rather than assuming it did.
It is written to the audit log as a warning, because it is a security event and should be visible as one.

Why this exists.

Without them, a lost phone would lock somebody out of the business, not just out of a device. The recovery codes and the reset give two ways back in.

API keys

Roles & Users → API keys → Generate
Scope it
Grant only the permissions the integration needs — for example transactions:write for a billing feed.
Bind it to a contact if the integration bills
Required for the monthly billing ingestion endpoint, so the aggregate lands on the right customer.
Copy the key now
The plaintext is shown once and never again. Store it in your secret manager, not in a chat message. If it is lost, revoke it and generate another.

How to use a key is covered in the developer docs.

Scopes are per module, read or write — invoices:read, contacts:write and so on, with full for an integration that genuinely replaces the app. Write includes read, and a key is a ceiling on what the person who created it could do rather than an expansion of it.
Keys are rate limited to 120 requests a minute by default, and the response headers tell your integration where it stands rather than making it guess.

API keys start on Business.

Business allows 1 API key and Professional 2 API keys at a time; Enterprise, Manufacturing and Practice each allow 10 API keys. Free and Starter hold none. Exporting your own data is on every plan from Settings → Data — the API is for another system reading and writing continuously. See pricing.

The audit log

Events are recorded with a severity — info, warning or error — and can be filtered by it. The log holds who did what and when, and is kept for seven years by default — the period the Companies Act asks of company records. An owner or administrator can lengthen it, and cannot set it below five years, the period the Tax Administration Act asks for. It is the first place to look when a figure changed and nobody remembers changing it.

POPIA also gives your data subjects rights you have to be able to act on: access, correction and deletion. Contact records and their communication history are exportable and deletable from the contact itself.

Common problems

What you see	What to do
Somebody cannot see a screen you expected them to	Two different gates, and the message says which. Not licensed is the plan — the module is not on your tier, and an add-on or an upgrade fixes it. Permission denied is the role, and it names the resource and the action it refused, which is exactly what to tick.
Buttons are missing rather than refusing	Intentional. Ledgr hides a write control a role cannot use, because a button that always fails reads as a broken app. If controls are missing that should not be, check the role rather than the screen.
A ticked permission still does not work	Every permission a role can be granted is one some part of Ledgr actually reads — there are no decorative checkboxes. If a specific action is still refused, the action needing the permission may not be the one you think: an hour logged on a workflow card needs time tracking, the chart of accounts needs banking, and receiving against a purchase order needs expenses.
A permission cannot be ticked at all	That pair does not exist. A dashboard has nothing to create; nothing in a contact, an invoice or a role definition waits for a second person to approve it. Only pairs something reads are offered.
"Cannot change the permissions of a system role"	The twelve built-in roles are fixed so an upgrade cannot silently change what your people can do. Build a custom role instead — start from the closest built-in and adjust.
A colleague has lost their authenticator	There are two ways back in. They can sign in with one of the ten recovery codes issued at enrolment — typed into the same box as a six-digit code, Ledgr tells them apart by shape. Or an owner or administrator can reset their two-factor from this screen, which revokes their sessions and emails them. You cannot reset your own.
"Codes cannot be checked right now"	A different message from a wrong code, and a different problem: Ledgr cannot check two-factor codes at the moment. Sign in with a recovery code and contact support.
Recovery codes have run out	Generate a new set from Settings → Security. A new set replaces the old one rather than adding to it, and is shown once — Ledgr stores only a hash, so no screen can ever show them again.
An invited user never received the email	The invitation reports whether it was sent rather than assuming it. If it says it was not, email sending is not working — give them the temporary password yourself and contact support; if it says it was, check spam and the address. A temporary password is never read out over the telephone — the invitation is the delivery.
An API key cannot reach an endpoint	A key holds scopes, and the endpoint catalogue names the scope each endpoint needs. A key with `full` reaches everything the plan licenses. API keys start on Business — see the plan matrix.
You cannot add another user	The plan's seat allowance is reached. Nothing is hidden and nobody loses access; only a new user is refused. A seat pack or the next tier raises it, and Ledgr says which would cost less.