Roles
Five roles, and each one is a deliberate amount of power.
| Role | What it can do |
|---|---|
| Owner | Everything, including billing and removing other owners. Keep at least two. |
| Admin | Invite and remove people, change settings, manage workspaces. Not billing. |
| Billing | Invoices and payment details. No access to drawings. |
| Member | Upload, review, export. The role most of your engineers hold. |
| Guest | A named outside person on specific workspaces only. |
Guests are how an engineering contractor's people work on your project without joining your organization. A guest seat can carry an expiry date, and an expired guest is no longer a member.
Inviting people
Settings to Members to Invite. Enter the address and pick the role.
If your directory is connected, skip this. Adding a person to the right group in your own directory creates their account here, and removing them there removes their access here.
Before you send fifty invitations
Ask whoever runs your mail gateway to allow our sending domain first. Fifty messages arriving at once from a domain your gateway has never seen is the usual reason half a team reports never getting the invite. It takes them a few minutes.
Requiring two-factor authentication
Settings to Security to Require two-factor.
Everyone gets a grace period to enrol rather than being locked out the moment you switch it on. Anyone who signs in through your identity provider is exempt, because your provider owns that ceremony including its own second factor.
Restricting access to your network
Settings to Security to Allowed addresses.
Enter the ranges your people actually come from. A request from anywhere else is refused, including one carrying a valid password.
Two things worth knowing before you turn it on. Add your remote workers' ranges, or a VPN they all use, or they will be locked out. And it applies to API keys separately, so an integration running from a data centre needs that data centre's range listed on the key.
The audit record
Settings to Audit log.
Every change to your account, your drawings, your billing and your security settings, with who did it and when. Downloadable at any time.
Each entry is linked to the one before it, so a removed or altered entry is detectable rather than silent. The download includes what you need to verify that yourself.
Anything we do on your account appears as an action by an operator rather than by one of your people, so you can always tell the difference.
Retention is seven years on an Enterprise agreement.
What a person keeps when you remove them
Their access ends immediately and their sessions end with it. Everything they uploaded or corrected stays with your organization, because it was your work, not theirs.