KYC documentation
Access rights
Who sees what, and who can change it.
This page is for account owners. It explains how to manage the rights of your users, which permissions exist and how roles work.
User hierarchy
The platform uses a two-tier hierarchy: the platform administrator, then the account owner, then the account users. The owner is the creator of the account and decides which rights and sections are available to the users through roles. Users are employees the owner has invited, and their capabilities are determined by the roles assigned to them.
Regular and advanced users
Users are regular or advanced, depending on whether the delegation permission is on in their roles. In the role editor it is called "Giving a subordinate access to part of the owner's partitions".
| Capability | Regular user | Advanced user |
|---|---|---|
| Access to assigned sections | Yes | Yes |
| Actions within their permissions | Yes | Yes |
| Password change and two-factor authentication setup | Yes | Yes |
| View the Roles tab | No | Yes |
| Create, edit and delete roles | No | Yes |
| Assign roles to other users | No | Yes |
| Manage the IP list (Security tab) | No | Yes |
| Invite new users | No | Yes |
| Import users from CSV | No | Yes |
| Disable and enable accounts, reset two-factor authentication | No | No (owner only) |
| Export the user list | No | No (owner and administrator only) |
An advanced user can only give others permissions that are present in their own roles.
Navigation sections
The sections in the side menu depend on the role: the Dashboard, KYC/AML, Face search, Persons, Sources, Access and Settings. Each of them can carry further permissions. The balance is not a menu item: it is shown in the top bar and is view-only.
The Settings section opens the user management page with these tabs:
| Tab | What it holds | Who sees it |
|---|---|---|
| Users | The user list, the user page and the company page. | Everyone with the Settings section |
| Roles | The role list, creating and editing roles. | The owner and advanced users |
| Logs | The sign-in log: date and time, user, IP, browser and device, with filters by date and by user. | Everyone with the Settings section |
| Security | The list of IP addresses that API requests are allowed from. | The owner and advanced users |
| Check statistics | Database checks, with overview, history and costs. | Depends on the permissions of the user |
Permissions by category
When you create a role, the editor shows the full permission tree.
| Category | What the permissions cover |
|---|---|
| User management | Viewing users and roles, creating, updating and deleting roles, assigning a role to a user, sending invitations, updating, disabling and enabling users, and the delegation permission. |
| KYC | Viewing the session history, viewing document images and selfie images, deleting sessions, changing the status of a session by hand, and viewing extracted data and the results of automatic document checks. |
| KYC schemes | Viewing, creating, updating, deleting and enabling scenarios, and viewing the scenario editor and the unique clients. |
| Session databases | Reading, creating, updating and deleting the database check data of sessions. |
| Face search | Viewing the search history, searching a person by image and creating and viewing face comparisons. |
| Persons | Viewing, creating, updating and deleting persons and lists of persons, and creating a fusion vector. |
| Data sources | Viewing, creating, updating and deleting groups of sources and sources. |
| Access tokens | Viewing, creating, updating and deleting tokens. |
| Logs | Viewing and exporting the face search logs and the KYC logs. |
| Image visibility | Which images the user sees: face images, document images, selfie images, face crops and person images. |
| API permissions | Which API operations are available through user-bound tokens. |
If the image permissions are not in a role, the user sees the session or person data, but the images are hidden.
Tasks
Invite a user
- Go to Settings, then Users, and open the company page.
- Open the menu and choose to add a user to the company.
- Fill in the first name, the last name and the email, and send the invitation.
- The system creates the user, assigns a role with a copy of your permissions (without delegation) and sends an invitation email. The new user accepts it and sets a password.
- If needed, change the role of the new user.
Import users from CSV
Open the company page, choose to import accounts and upload a CSV file with the columns for email, first name, last name and password. The system creates the users and sends invitations. This is available to the owner and to advanced users with the invitation permission.
Create a role
- Go to Settings, then Roles, and click Add role.
- Enter the name and, if you wish, a description, and continue.
- Select the permissions in the tree. Checking a parent item includes all nested items. Unchecking a child item unchecks its parent. Only permissions that you have as the owner are available.
- Check the list of selected permissions and create the role.
To edit a role, click Edit in its row. Clicking the role name only opens it for viewing.
Assign a role
Go to Settings, then Users, open the user card, turn the roles on or off in the roles and rights block and save.
Block and unblock a user
Available to the account owner only. Open the user card and choose to disable or enable the account. A blocked user cannot sign in, but their data is saved. The same menu lets the owner reset two-factor authentication for a user who lost the authenticator app.
Manage the IP list
Go to Settings, then Security, and add, change or delete an address in the block of addresses that API requests are allowed from. Save. The list limits the addresses that API requests are accepted from. It does not limit signing in to the dashboard. It affects all users of the account, including you.
Changes by the platform administrator
If the platform administrator changes your permission set, it affects all users of your account. Revoking a permission from the owner removes it from all roles. Adding a permission to the owner makes it available for assignment, but it does not appear in existing roles by itself. Add it to the roles you choose.
Questions
Why does a user not see some sections? Section visibility depends on the role. Check the navigation permissions in the role.
Why can a user not perform an action although they see the section? Seeing a section and performing an action are different settings. Add the permission to the role.
Can a user be given more than the owner has? No. When you create a role, only the permissions that you have as the owner are available.
What happens if a role is deleted? The users lose all permissions of that role. A user with only that role can still sign in but sees no work sections.
How does a user change the password or set up two-factor authentication? In the profile. See user profile.