Team members and passwords
Create accounts, send invitations, set or reset passwords and remove access.
Open Settings › Users. You need user management permission (owners have it by default). Every change asks for a reason and is recorded in the audit trail.
Two ways to add someone#
Create the account yourself#
Best when the person is with you, or has no email address.
- Under Create a team account, enter their name and a sign-in email or username.
- Optionally add their phone number. It is stored encrypted.
- Choose a role, a campaign and an access scope: whole campaign, or specific counties, constituencies, wards or polling stations.
- Choose Create user. Sauti shows a temporary password once. Give it to the person privately; it is never shown again and never emailed.
- At their first sign-in they must choose a new password and set up their authenticator.
Send an invitation#
Best for people working remotely.
- Under Invite a team member, enter their name and email address, choose the role, campaign and scope, and give a reason.
- They receive a link valid for 72 hours and set up their own sign-in methods.
- Pending invitations are listed below the form. You can resend (re-enter the address, because Sauti does not keep it readable) or revoke them.
To invite many people at once, use Bulk invite by CSV (up to 100 rows) with the header name,email,role_id,campaign_id,level,ids. For whole-campaign access use level=campaign and leave ids empty. Separate several geography IDs with semicolons.
Changing someone's access#
Select a team member to change their role, campaign, geographic scope or status (Active or Disabled). Disabling someone stops them signing in straight away without deleting their history.
Recovery actions#
For a team member who has lost access, you can:
| Action | Use it when |
|---|---|
| Set new password | They forgot their password. A typed or generated password is shown once, they must change it at next sign-in, and all their sessions end |
| Reset TOTP | They lost their authenticator app |
| Reset all passkeys | A device with their passkey was lost or stolen |
| Sign out all devices | You suspect their account was used by someone else |
Recovery actions need a fresh check of your own identity: your password or an authenticator code from the last 5 minutes.
Note: You can only set a password for someone whose only active organisation is yours. People who belong to several organisations receive a reset link instead.
Good practice#
- Give each person their own account. Never share sign-ins.
- Use the narrowest role and area that lets someone do their job.
- Disable accounts on the day someone leaves the campaign.
- Review the users list monthly: the Last login column shows unused accounts.