Team and roles

This page covers how to get your team operating inside LealUp with the right permissions.

The 4 roles

LealUp has 4 application roles. Each role has a set of per-feature permissions (see the matrix below).

Role	For whom	Can do
admin	Whoever configures and maintains the platform	Everything. Create/edit/delete customers, playbooks, health model, fields, integrations, users.
director	Head of CS, CSO, CS Ops	View the whole book, edit health and playbooks, see aggregate dashboards, export. Doesn't edit customers directly (that's what CSMs are for).
csm	Customer Success Managers	View and edit customers in their book, run playbooks, log activity, see their personal dashboard.
viewer	External stakeholders, audit, sales	Read-only on anything they have access to. Doesn't edit anything.

Permissions matrix (full)

Permissions are defined by feature × action. The features LealUp controls:

customer_360, health_scoring, segments, playbooks,
notifications, renewals, dashboard, data_export,
team_management, analytics, custom_fields

Actions: view, create, update, delete, config, execute, personalize, export.

Summary by role

Feature	Admin	Director	CSM	Viewer
Customer 360	full	view	view+edit (book)	view
Health scoring	full	view+config	view	view
Segments	full	view+config	view	view
Playbooks	full	view+config+execute	view+execute	view
Renewals	full	view+config	view	view
Dashboard	full	full	view+personalize	view
Data export	full	export	export (own)	—
Team management	full	view	—	—
Analytics	full	view+config	—	view
Custom fields	full	view	view+update	view

The detailed matrix lives in code (backend/app/core/permissions.py). If you need a custom role, it is not configurable through the UI today: write to us and we will talk it through.

Invite users

Admin → Team → Invite

Enter email and role.
Optionally assign initial book (which customers this CSM will see/edit).
Click Send invitation — an email arrives with a unique link to your workspace subdomain.

Invitees accept, complete their profile (name, timezone, language), and become active.

Bulk invite

If you're inviting 10+ people:

Admin → Team → Import CSV with columns email,role,territory_id (optional).
Each row is processed as an individual invite.
Errors (invalid email, unrecognized role) are reported at the end.

Book assignment

Each customer has one assigned CSM, exactly one. There are no co-owners: someone else seeing the account depends on their role's data scope, not on assigning it twice. See Roles and permissions.

There are two ways to assign, both manual.

One account

On the customer record → ••• menu → change the assigned CSM.

Several accounts at once

In Customers, select the rows you want and use the bulk action bar to assign or unassign the CSM on all of them together.

This is the practical route when someone leaves the team or changes book: filter by their name, select everything, reassign in one operation.

Only roles with management permission can reassign someone else's accounts; a CSM cannot move accounts to themselves.

Users sign in with Google or with email and password, always by invitation to the workspace.

Audit log

Settings → Audit logs

All sensitive actions are recorded:

Login / logout / failed login.
Role changes.
Invitations and removals.
Health model changes.
Exports.
Customer deletions.

Queryable by user, date, action. Exportable to CSV/JSON.

Remove users

Admin → Team → [user] → Deactivate

The user loses access immediately.
Their book stays in limbo until you reassign it (LealUp warns you at deactivation).
Emails/notes they left stay visible, attributed to them.
You can reactivate at any time.

Permanent delete is different — requires double confirmation and wipes the profile. Emails stay attributed to "Deleted user". Only available for GDPR compliance.

Best practices

1 primary admin + 1 backup. Don't leave a single admin — if they leave, someone needs to be able to take over.
Review the audit log weekly for the first 2 months post-deploy.

On this page