Team roles, SSO, MFA and encryption
Team roles, SSO, MFA and encryption
Who can see and change what, and how sign-in and data are protected.
| Role | Can |
|---|---|
| Owner | Everything, including billing, retention and deleting the account |
| Admin | Change settings, connectors, procedures, thresholds; start tests |
| Agent | Review drafts and see ticket text, transcripts and test results |
| Viewer | See dashboards and reports without ticket text |
- There are no per-seat fees — invite your whole team.
- SSO/SAML and an enforced MFA policy are available on Growth Pro.
- Credentials and secrets are encrypted at rest; on Growth Pro each account can use its own encryption key, rotated automatically.
- Personal data (emails, phone numbers, card numbers) is replaced with tokens before any text reaches the AI and restored only in the final reply.
Tips & tricks
- Give most people the Agent role — keep Admin for the few who change thresholds, connectors and procedures.
- Use Viewer for managers and stakeholders who only need the numbers; they never see ticket text.
- Turn on enforced MFA before you connect production help desks, so every account that can see tickets is protected.
- Remove leavers from the team list the same day — with no per-seat fees there is no reason to share logins.