For Owners and Admins of a workspace. End-user features (dashboards, reports, finance day-to-day) are covered in the User Guide.
1. Your workspace
Your workspace lives at your own subdomain and carries your branding: logo (light/dark), colours and login page (Settings → Branding). Colour changes are contrast-checked automatically so text always stays readable — a colour that fails WCAG AA is rejected with the exact reason.
Interface language is per user (English/Arabic, full RTL); numbers can use Western or Eastern Arabic numerals workspace-wide.
2. Users, roles and access
Settings → Users shows members, their role, data scope, 2FA status and seat usage (e.g. "7 of 15 seats"). Seats count active members + pending invitations; past the plan limit, inviting is blocked with an upgrade message.
- Invite: email + role. Invitations expire; you can revoke pending ones.
- Remove: the remove icon in a member's row takes them out of the workspace at once (their seat is freed, their past actions stay in the audit log). The owner cannot be removed and nobody can remove themselves.
- Roles (Settings → Roles): six defaults (Owner, Admin, Account Manager, Analyst, Finance, Viewer) plus custom roles via the permission matrix. The Owner role is not editable.
- Data scopes: restrict a member (or role, or team) to specific creators and/or clients. Scopes are enforced server-side on every data query — a restricted analyst's dashboard, posts, exports and reports only ever contain their creators.
- Effective access: the key icon on a member row shows exactly what they can do — role, teams, scopes, and the full permission list.
3. Security
Settings → Users → Security:
- Your 2FA: enable a TOTP authenticator (Google Authenticator or similar) — add the setup secret, confirm with a 6-digit code. Login then requires the code.
- Workspace policy — require 2FA: blocks members who haven't enrolled from the workspace until they do (they can still sign in and enrol). You must enable 2FA on your own account first — the toggle refuses otherwise, so you can't lock yourself out.
- Google sign-in and passkeys: members may sign in with a Google account that uses their membership e-mail, or with a passkey they register under Security. Both still respect the workspace 2FA policy.
Passwords: minimum 10 characters, and passwords found in breach lists ("password123" and friends) are rejected outright.
Repeated failed logins lock an account for 15 minutes. All of this is audited.
4. Audit log
Settings → Users → Audit log: who did what and when — logins,
permission changes and denials, account connections, manual data edits,
financial document changes, exports, report shares (including public share
accesses). Filter by action prefix (e.g. auth. or invoice.) and page
back as far as you need.
5. Connected accounts & data health
Connected accounts lists every social account with its platform, mode (Official API / Provider / Manual), status and last sync:
- Statuses: Connected, Token expiring (re-auth soon), Error (with the actual error), Disconnected (history kept).
- Refresh now queues an immediate sync. Daily syncs run automatically in your workspace's sync window.
- The header shows data freshness workspace-wide, and failing accounts notify the owner and every member whose role can connect accounts after retries are exhausted — in-app and by email, per each member's profile preferences.
- Which connection modes are available per platform is set by the platform vendor; Manual is always available.
- Plan limits cap accounts per platform and creators — exceeding shows an upgrade message.
Settings → Users → Background jobs shows queue health (sync, reports, maintenance) and any failed jobs of your workspace with their error text.
6. Manual data and evidence
Manual entries (for platforms without APIs, e.g. Snapchat where not
connected) can carry a screenshot as evidence; the screenshot is visible
from the post explorer. An optional approval flow routes entries through
Pending approval before they count. Every manual edit is audited with
before/after values.
7. Finance configuration
Settings → Finance: currency, tax rate, quotation/invoice numbering format (sequential, never reused, yearly reset), payment terms, expense categories, and client payment reminders (which days after the due date a reminder goes to the client's primary contact). Document PDFs embed Arabic-capable fonts and your branding.
8. E-mail, data & continuity
- Every e-mail Onyx sends on your behalf — notifications, payment reminders, scheduled reports — is branded with your name and colours and carries a one-click unsubscribe link. A client contact who opts out of payment reminders is marked on the contact record; clear the flag only with their consent.
- Excel/PDF generation always runs in the background — large exports never block the app. A report whose PDF fails to render shows Failed in the library with a Retry button; the author is notified either way.
- Backups: the platform operator runs daily database backups with a documented restore procedure (ask your vendor for the schedule).
9. Teams, domains, export and deletion
- Teams (Settings → Users → Teams) group members and carry creator / client scopes; a member inherits the union of their role scope and their teams' scopes.
- Custom domain (Settings → Workspace): enter your host, point a CNAME at the platform, and the certificate is issued on the first visit.
- Export workspace produces a full JSON + CSV archive in the export library (owner only) — also while the workspace is read-only, so your data is always yours to take. Delete workspace requires typing the subdomain; the workspace locks immediately and is purged after the grace period, during which the owner can cancel from the workspace list.
10. Integrations
Settings → Integrations (requires Workspace settings):
- API keys — read-only keys with analytics / CRM / finance scopes for BI tools and scripts. The secret is shown once; revoke any time. The interactive API reference is linked from this screen when your deployment serves it; otherwise ask the vendor for the OpenAPI document.
- Webhooks — HTTPS endpoints that receive signed events (sync completed/failed, invoice overdue, payment recorded, report/export ready, client/campaign created, manual entry pending). Ten failures in a row switch a webhook off.
- Channels — Slack, Microsoft Teams, WhatsApp (Meta Cloud API) or SMS destinations for the same events. Send test confirms the setup.
11. AI assistants (Scale plan)
Settings → AI assistants lets members connect Claude, ChatGPT, Cursor or any assistant that supports remote MCP servers. Each connection acts as that member, read-only, within their role and data scope; nothing can be created, changed or deleted through an assistant. Members see and disconnect their own connections; connections and the data they read are audited.
12. Trial, subscription and read-only
A workspace created through self-service sign-up starts on a free trial. Seven days before the trial (or a subscription renewal) ends, the owner is notified in-app and by e-mail. When it ends the workspace becomes read-only: members can still sign in, read and export everything, and the owner can still export the whole workspace — nothing is deleted — until the subscription is activated or renewed.
Settings → Workspace → Subscription shows the plan and renewal date and, when in-app billing is enabled, a Pay now flow (1/3/6/12 months, mada, cards, Apple Pay); access returns the moment the payment is confirmed. Where billing is handled directly, contact the vendor at support@onyxksa.com. Request upgrade sends a note to the vendor when you need more seats, creators or features.