Administration
Permission-based dashboards, invitations, and account revocation.
- Granular permissions — fifteen permission codes across members, enrollment, finance, reports, users, audit, settings, and billing.
- Virtual, tenant-scoped usernames — no email mailbox is created, and the same username can exist in different churches without collision.
- Single-use invitation links — invitations expire in seven days and self-destruct on claim; new staff set their own password at claim time.
- Immediate revocation — deactivating a user kills live sessions on the next request, so there is no stale-tab risk.
- Finance is separate — buying ROMANS Lite does not automatically grant finance access; the initial admin explicitly assigns financial permissions.
- Tenant isolation — each church's data is scoped at the database and API layers, and is verified by automated cross-tenant tests on every deploy.