1. Onboard Your Team

Invite users by email, assign roles, and approve access requests. Each user gets a role — Read-only, Sales, Admin, or Super Admin — that determines exactly what they can see and do across every EmpireVault module.

2. Configure Access

Assign tool entitlements per user at full or lite tiers. Connect your identity provider via WorkOS for SSO with SAML or OIDC — Azure AD, Okta, and others are supported out of the box. Permissions are enforced at every controller action.

3. Monitor & Bill

Track every user action across 90 auditable event types in an immutable log. Manage your subscription plan, add or reduce seats, and handle billing through integrated Stripe checkout — all from the Hub dashboard.

User Management

Invite new users, approve pending sign-ups, suspend accounts, or deactivate departing team members. Users can belong to multiple organizations and switch between tenants seamlessly. A seat-usage dashboard warns you before you hit your plan limit.

Role-Based Access Control

Four built-in roles — Read-only, Sales, Admin, and Super Admin — map to a granular permission matrix covering every resource in the platform. Permissions are checked at the controller level with an Authorizable concern, and role hierarchy prevents privilege escalation.

Single Sign-On

Authenticate through WorkOS with support for SAML and OIDC protocols. Connect Azure AD, Okta, Google Workspace, or any compliant identity provider. Users sign in once and access every EmpireVault module without additional credentials.

Subscription & Billing

Plans are database-backed and fully dynamic — pricing, included tools, and seat limits are configurable by administrators. Subscriptions progress through trial, active, grace period, and expired states. Stripe handles checkout, plan changes with proration, and seat add-ons at $49 per seat per month.

Tool Entitlements

Each module — CRM, Tickets, Engage — can be entitled at full or lite tier per user. Entitlements are tied to pricing plans, so upgrading a plan automatically unlocks the right tools for every user on the account.

Immutable Audit Log

Every significant action across the platform — logins, record changes, permission updates, billing events — is recorded in a tamper-proof audit log covering 90 event types. Filter by user, action, resource, or date range for compliance reviews and incident investigation.

Multi-Organization Support

Users can belong to multiple organizations and switch between them seamlessly via a tenant switcher in every sidebar. Each organization has its own data, roles, entitlements, and billing. Ideal for agencies, consultants, or teams managing multiple business units.

Bulk User Import

Import users via CSV upload with a downloadable template. Bulk invite your team during onboarding instead of sending invitations one at a time. The system validates emails, checks for duplicates, and assigns roles automatically.

Subscription Lifecycle

Self-service subscription management: upgrade, downgrade, or cancel through the billing portal. Cancellations include a confirmation step and can be reversed before the billing period ends. After cancellation, admins have 30 days to export data. Subscription states progress through trial, active, grace period (read-only), and expired (admin-only).

Dynamic Pricing Administration

Platform administrators can create and manage pricing plans via the admin dashboard. Each plan defines included tools (at full or lite tier), seat counts, and monthly pricing. Plans are database-backed with admin UI for full CRUD, and the system falls back to default plans if no custom plans are configured.