Team, seats and roles
| Role | Can | Takes a seat |
|---|---|---|
| Viewer | Read the workspace data allowed by their site access | No, viewers are free and unlimited |
| Client | Read results and reports for selected sites; no workspace administration | No, clients are free |
| Analyst | Viewer, plus change topics and competitors, plan and work plays, run checks and hand-offs, start and end experiments, start runs, add and verify sites, edit goals and schedules | Yes |
| Admin | Analyst, plus invite people, manage API keys, integrations, branding and settings, choose the plan and seats, set up single sign-on | Yes |
| Owner | Admin, plus change roles, invite owners, remove admins, enforce single sign-on, sign the data processing agreement | Yes |
A workspace always keeps at least one owner: make someone else owner before leaving or stepping down.
Site access and client boundaries
Section titled “Site access and client boundaries”Owners and admins can access every site in their workspace. Analysts and viewers can be restricted to selected sites; without a restriction they can access every site. A client always has a selected-site list and a narrower set of permitted actions. A viewer role alone is not client isolation.
Under Settings, Members & seats, choose Sites for an eligible member, or select the site list when inviting them. Check the selected domains before sending an invitation. Moving someone to admin or owner gives them workspace-wide access.
Use separate client workspaces when that is the required operating boundary, or configure site limits within a shared workspace. Agency owners/admins may also have administrative access to their linked client workspaces. Report branding changes presentation only; read-only report links and API keys have their own scope and expiry. Test access with the intended role before sharing a report.
See integrations and exports and white-label reports for the related settings.
A seat is taken by every owner, admin and analyst, and by every open invitation for one of those roles. An invitation that expired holds nothing.
| Starter | Growth | Portfolio | Enterprise | |
|---|---|---|---|---|
| Seats included | 3 | 5 | 15 | 50 |
| Extra seats | per seat | per seat | per seat | set by the contract |
On Starter, Growth and Portfolio, an admin or owner adds seats under Settings, Members & seats (Add seats, Remove seats) or from the Plan page. An extra seat is a monthly price per seat (ten months’ price for twelve on an annual plan), stated on the pricing page; an added seat is charged for the rest of the billing period on the next invoice, and a removed one is credited. Seats cannot go below the number in use. On Enterprise, seats are set by the contract; ask us to change them.
Switching plan carries the seats in use beyond what the new plan includes at that plan’s seat price. When a subscription ends, bought seats end with it.
Inviting someone
Section titled “Inviting someone”Settings, Members & seats, Invite people: an email and a role (analyst unless you choose another; only an owner invites an owner). The invitation is emailed, is valid for 14 days, and attaches the moment that address signs in, with a password, single sign-on, Google or Microsoft, so there is nothing to accept. Inviting the same address again replaces the open invitation; Revoke invitation frees its seat.
A workspace without a plan sends up to 3 invitations a day and 10 in all; a plan lifts the limit. An address that bounced or reported an earlier Vercatus email as spam is not emailed: the invitation stays open and attaches when that person signs in with the address.
When no seat is free, the invitation is not sent: add a seat first, or invite the person as a viewer. The same holds for making a viewer an analyst, admin or owner. If a workspace loses seats between the invitation and the sign-in, the person joins as a viewer and the audit log says so.
Changing roles and removing people
Section titled “Changing roles and removing people”Owners change roles from the members table. A member can be removed through the API: admins remove analysts and viewers, and only an owner removes an admin or an owner. Removing a member ends their sessions in the workspace and frees the seat. Every invitation, role change, removal and seat change is in the audit log.
Your account
Section titled “Your account”Your name at the bottom of the navigation opens the account menu: Account (your email and whether it is confirmed, your name as it appears to colleagues and in the audit log, a password change that signs out every other session, and the workspaces you belong to), the documentation, the theme, and Sign out.
Signing in
Section titled “Signing in”People sign in with an email and a password, or, where the sign-in page offers them, with Continue with Google or Continue with Microsoft, which link to the account with the same address once Google or Microsoft confirms it. Someone without a workspace who signs in this way creates an account and continues to the welcome, as on Create your account. Workspaces on Enterprise can route their domains to their own identity provider; see Single sign-on.
API keys
Section titled “API keys”Admins create keys under Settings, API & webhooks. A key acts as its workspace with analyst or viewer
rights depending on its scopes, is shown once, and can be revoked at any time. Send it as
Authorization: Bearer ca_…. Keys take no seat.