A user account identifies a person. An organization membership connects them to a workspace. Its role describes their work relationship. Permissions, account ownership and login method are separate choices.
Permissions and scope
Read access permits inspection. Write access permits changes within the granted scope.
| Permission | Scope |
|---|---|
| Manager | Work in the organization or selected projects. |
| Accountant | Finances in the organization or selected clients. |
| Ticket access | Assigned tickets or all project tickets, with separate read and write levels. |
| Superuser | Organization administration, including manager and accountant rights. |
Membership roles include employee, freelancer and observer. Observers have restricted participation. Guest-organization memberships represent partner businesses that assign workers locally.
Use Members for organization-member settings. For project permissions, expand the project under Projects and select the member. Assign client accountants in the client view. Inherited rights can make lower settings unavailable. See the access screen.
Account ownership
An independent account stays under the person’s control. It can join several organizations and create an organization where permitted. An organization-managed account is controlled by one organization. While managed, the person cannot create another organization or delete the account themselves.
Employees can be independent; freelancers can be managed. Changing role does not transfer ownership.
Local accounts use Treetops passwords. Account ownership and directory authority can restrict password changes and recovery. Email-address changes require verification.
Invitations and employment conversion
Invitations ask the person to accept a membership or account change. Open them from personal Organizations and read the proposed effect.
- Membership invitations add participation without transferring ownership.
- Managed-account invitations transfer ownership to the inviting organization.
- Employment-conversion invitations change freelancer membership to employee. Ownership depends on the stated intent.
- Lifecycle-only invitations change ownership while keeping the work role.
Authorized editors can onboard managed staff through Members. Check the account-control choice before completion.
The organization can directly convert its active managed freelancer when there is no active direct membership elsewhere. An organization superuser can also convert their own freelancer role directly. Other independent or foreign-managed accounts need invitation and, where applicable, release steps.
A freelancer moving future work into their own business uses a different process. Historical work stays on source memberships, and each host approves separately.
Directory accounts
LDAP is a staff directory service. Provisioning and synchronization maintain identities and memberships. They can leave local Treetops passwords in use.
Directory password verification requires the same organization to own the account and enable LDAP user-bind. Local password changes and recovery are then blocked. A directory match alone does not transfer password authority.
Superusers configure LDAP under organization Settings. Contact Gorilla Computing before you connect a directory. A local membership archive prevents automatic reactivation from an active directory result.
Choose the features in use
As a superuser, open organization Settings and choose a stage under Features in use. Each stage also hides what the stages before it hide. The page reloads after you save a new stage.
| Stage | Effect |
|---|---|
| All features | Nothing is hidden. |
| No client invoices | Stops new organization-to-client invoices. Valuation, rates, expenses, financial reports and project planning remain available. |
| No financial management | Also hides rates, money targets, expenses, other income, tax settings and finance charts. Time, projects, categories, assignments, tickets, hour targets, review, forwarding, work schedules and leave remain available. |
| Time tracking only | Also hides annual and sick leave, entitlement, work schedules and non-working dates. People still record time; Mikron pages show logged hours without expected hours or leave markings. Tasks, tickets, projects and hour targets remain available. |
A stage hides features and deletes nothing. Stored values and processing states appear again when you choose an earlier stage. While a part is hidden, nobody can change it.
Schedule editors omit salary money with No financial management.
Freelancer personal invoices remain available through Profile → Bills with permission. Incoming invoices and authorized processing of existing invoices also remain. The organization’s Bills entry disappears only when there is no authorized history across all dates and states; a new incoming invoice can restore it.
Before the next client invoice after returning to an earlier stage, inspect the work period and automatically proposed expenses. Treetops does not know what you invoiced elsewhere, and automatic expenses are not limited to the selected work dates.
Partnerships
A partnership shares work between organizations while keeping separate ownership and records. The host owns shared projects and categories. The guest assigns local workers within granted access. A linked client in the guest represents the host for billing.
Local permissions cannot broaden host task or ticket grants. Name-transfer settings control which individual names cross the boundary.
Forwarding passes reviewed work upstream. The host keeps its own review and billing state. Read the partner work and billing steps and review instructions.
Archive, release and deletion
Archiving makes a membership inactive and retains its history. It does not delete the account or change its owner.
Release returns a managed account to the person. It clears the former owner’s LDAP linkage and requires a new password. A person can request release; the owner must complete it.
Deletion can remove an account permanently. Other memberships, including archived ones, or owned personal invoices can require release and retention instead. Personal invoice protection continues after cancellation. Work records alone do not guarantee retention.
Read deletion previews. Arrange another administrator before removing the last active superuser. Shared projects and partnerships have separate history rules, not a general backup guarantee. Explore access and administration or project archives.
Logbooks
Open a resource’s logbook to inspect recorded changes and actions within your permissions. Retention settings limit how far back the history remains available.