Add a user
1
Open Settings → Users
Only an admin, or someone whose role allows managing users, sees this screen.
2
Create the user, or invite them
New user creates the account with a password you set. Invite user emails a link instead; the person sets their own password and joins your company. An invitation link expires after 7 days.
3
Give them a role
Pick one or more roles, for example Accountant or Quality Inspector.
4
Choose record visibility
Global shows every record in the company, Group shows records owned by their team, and Individual shows only their own, such as a salesperson’s own quotations.
5
Save
The user can sign in at your company address straight away.
When the company reaches its plan’s user limit, ARUKZ ERP refuses to create another user. Deactivate someone who has left, or move to a bigger plan in Settings → Subscription.
Roles
A role is a named set of permissions, one set per screen: view the list, view one record, create, edit and delete. There are two kinds.
To make your own, open Settings → Roles → New role, name it, tick the screens and actions it needs and save. Two companies can each have a role with the same name without seeing each other’s.
Example: a QC Inspector who sees only Line 2
Example: a QC Inspector who sees only Line 2
- Settings → Roles → New role, name it
QC Inspector. - Tick Quality inspections (view, create, edit), Inventory products and lots (view) and Sales orders (view). Leave Accounting and Payroll unticked.
- Settings → Users → Ravi: role
QC Inspector, record visibility Group, teamLine 2 QC. - Ravi now sees the Quality menu but not Payroll, only your company’s records, and only what his team owns.
Deactivate, do not delete
When someone leaves, switch their user to inactive. They can no longer sign in, every API token they held stops working, and the records they made keep their name. Changing a user’s password also ends all their API tokens.Two-factor sign-in
Each person can turn on two-factor sign-in with an authenticator app from their own profile, and keep recovery codes in case they lose the phone. An account with two-factor sign-in cannot get an API token by password, because the API login has no second step.What a company admin cannot do
- Give anyone, including themselves, the ARUKZ platform role. The check is on the server, not only hidden in the form.
- See or edit users of another company.
- Change the shared roles, install plugins or add custom database fields. Ask ARUKZ support.
Security and data
How one company is kept apart from another.
Audit trail
Who changed what in the books.