Roles and capabilities

Three roles, and they are the only assignable unit. See Your team and their roles for how to assign them.

The table

Capability	Admin	Accounting	Tech
Create a site	yes	yes
Buy, change, expand or cancel a plan	yes	yes
Payment methods, checkout, invoices, credits, offers	yes	yes
Read plans, credit, offers, card status, coupons	yes	yes
Transfer users: create, edit, disable, remove, reset second factors	yes		yes
Enrollment codes: mint and revoke	yes		yes
Connectors: view and disconnect	yes		yes
Site configuration, custom domains, protocols, security	yes		yes
Be right back: pause and resume a site	yes		yes
Read users, connectors, configuration, usage, status, addresses, bans	yes		yes
Team: invite, change roles and scopes, remove members	yes
Support grants: create, approve, revoke	yes
Read the account activity trail	yes	yes	yes
Service level and tamper evidence pages	yes	yes	yes

The shape of it

Admin holds everything.

Accounting holds the money path and only the money path, plus the money reads. An accounting member can buy a site and can never configure one.

Tech holds every technical surface and can never cause a charge, a purchase or a plan change.

Every role reads the audit trail. It carries action metadata, never file content, and transparency inside a customer's own team is deliberate.

Site scoping

Accounting and tech members can carry a site scope: an explicit list of sites, or all sites including ones created later.

A scoped member's world is their scope:

• Site lists and the dashboard filter to it.
• A site outside the scope answers exactly as a site belonging to somebody else would.
• Audit entries for sites outside the scope are not shown.

Admin is always account wide. There is no scoped admin.

Creating a new site needs account wide reach, so it takes an admin or an unscoped accounting member.

Enforcement

The matrix is enforced in the API, not by hiding buttons. A request that a role may not make is refused whether or not the interface offered it.

The one structural guard

At least one active admin must always remain. Removing the last one, or changing their role, is refused.

Support sessions

When Syncplify support views your account under an active support grant, that session holds read capabilities only, whatever the operator's own role is.

Every action taken under a grant is written to your Activity log with the grant's id.

These are not your transfer users

Everything on this page is about people who sign in to the Portal to manage your account.

The accounts your people transfer files with are a separate thing entirely, with their own permissions, granted on your Connector. See Permissions.