Access control and permissions

Access in Pertavo is decided by three things stacked on top of each other. Nearly every “why can they see this?” question is answered by working down the list.

1. Role

Your role within the firm decides what kind of thing you can do at all: a client only ever reaches their own records, a CPA reaches the firm’s work, an admin also reaches the firm’s configuration. Roles are checked on the server on every request. See Understanding user roles and permissions.

2. Folder permissions

A folder is private or shared, and a shared folder carries view, edit or admin permission for the people it is shared with. Permission on a folder applies to what is inside it, including documents added later — which is what makes folder sharing convenient and what makes it easy to over-share. See Organizing with folders.

3. Document sharing

A single document can be shared with a person at view, download or edit. This is the narrowest tool and the right one when exactly one file should change hands.

Working out why somebody can see something

Start at the top. If a colleague can see a document, it is almost always their role rather than anything shared — a CPA can already reach the firm’s documents. If a client can see something you did not expect, check the folder before checking the document: a folder shared once carries everything that has landed in it since.

Working out why somebody cannot

Same order. A client who cannot open what you sent has usually been given the document but not download access, or has been given the folder at view when they needed edit.

Taking access away

Remove the share, or move the document out of the shared folder. Either takes effect at once. Neither retrieves a copy somebody has already downloaded, which is the reason to think twice about download access rather than about view access.

A rule that keeps this simple

Share folders to clients, share documents to individuals, and review what a folder contains before you share it. Firms that do those three things rarely have an access question at all.