Roles and Permissions
Built-In Roles
| Role | Description | Typical User |
|---|---|---|
| Admin | Full access to all features, settings, and user management | QSA firm principal, IT administrator |
| Manager | Manage assessments, tasks, and team members; approve findings; export reports | Senior QSA, engagement manager |
| Contributor | Complete assessments and manage tasks; upload files; no user management | Associate QSA, ISA |
| Viewer | Read-only access to all data; no editing or management capabilities | Client stakeholder, external reviewer |
Permission Matrix
The table below shows exactly what each role can do across every resource category:| Permission | Admin | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Assessments | ||||
| View assessments | Yes | Yes | Yes | Yes |
| Create assessments | Yes | Yes | — | — |
| Edit assessments | Yes | Yes | Yes | — |
| Delete assessments | Yes | — | — | — |
| Approve findings | Yes | Yes | — | — |
| Export ROC | Yes | Yes | — | — |
| Tasks | ||||
| View tasks | Yes | Yes | Yes | Yes |
| Create tasks | Yes | Yes | Yes | — |
| Edit tasks | Yes | Yes | Yes | — |
| Delete tasks | Yes | Yes | — | — |
| Files | ||||
| View files | Yes | Yes | Yes | Yes |
| Upload files | Yes | Yes | Yes | — |
| Edit file metadata | Yes | Yes | — | — |
| Delete files | Yes | — | — | — |
| Users | ||||
| View team members | Yes | Yes | — | — |
| Invite members | Yes | Yes | — | — |
| Edit roles | Yes | — | — | — |
| Remove members | Yes | — | — | — |
| Reports | ||||
| View reports | Yes | Yes | Yes | Yes |
| Create reports | Yes | Yes | — | — |
| Export reports | Yes | Yes | — | — |
| Delete reports | Yes | — | — | — |
| Integrations | ||||
| View integrations | Yes | Yes | — | — |
| Add integrations | Yes | — | — | — |
| Edit integrations | Yes | — | — | — |
| Remove integrations | Yes | — | — | — |
| Settings | ||||
| View settings | Yes | Yes | — | — |
| Edit settings | Yes | — | — | — |
| Manage security | Yes | — | — | — |
Custom Roles
Admins can create custom roles that combine any set of permissions:Click Create Role
Click the + Create Role button. A dialog opens with a role name field, description, and a full permission selector.
Select Permissions
Permissions are organized by category (Assessments, Tasks, Files, Users, Reports, Integrations, Settings). Check individual permissions or use Select All / Clear per category.
Built-in roles (Admin, Manager, Contributor, Viewer) are marked as “System” roles and cannot be modified or deleted. Only custom roles can be edited or removed.
Inviting Team Members
Kliper supports two methods for adding team members to your organization.Method 1: Invite by Email
Use this when the person does not yet have a Kliper account, or when you are unsure.Navigate to Team Settings
Go to Settings > Team. The team management page shows your current members, pending invitations, and admin count.
Select the Invite by Email Tab
Enter the invitee’s email address and select a role from the dropdown:
| Role | Description |
|---|---|
| Admin | Full access to all features and settings |
| Editor (Manager) | Can edit and manage assessments and content |
| Viewer | Read-only access |
Method 2: Add Existing User
Use this when the person already has a Kliper account but is not in your organization.Search for the User
Type at least 2 characters of the user’s name or email. The search returns matching users who are not already in your organization (up to 10 results).
Managing Invitations
The Team Settings page shows all pending invitations. For each pending invitation, you can:- Resend — send the invitation email again (useful if the original expired or was missed)
- Revoke — cancel the invitation before it is accepted
Domain-Based Discovery
When a new user signs up with an email domain that matches your organization’s allowed domains, they can discover your organization and request to join. The organization’s Domain Join Policy controls this:| Policy | Behavior |
|---|---|
| Auto Join | Users with a matching email domain are added automatically |
| Manual Approval | Users with a matching email domain can request to join; an admin must approve |
| Closed | No domain-based discovery; invitations only |
Managing Team Members
Viewing Your Team
Navigate to Settings > Team to see a table of all organization members:| Column | What It Shows |
|---|---|
| Member | Name and email address |
| Role | Current assigned role (Admin, Editor, Viewer, or custom) |
| Status | Active, Pending (invitation sent), or Invited |
| Last Active | Timestamp of last platform activity |
Changing a Member’s Role
From the team members table, click the actions menu on a member’s row and select Change Role. Choose the new role from the dropdown and confirm. The role change takes effect immediately.Removing a Member
Click the actions menu and select Remove from Team. A confirmation dialog appears. On confirmation, the user’s membership is deactivated and they lose access to all organization data.Team Statistics
Three cards at the top of the Team Settings page summarize your team:| Card | What It Shows |
|---|---|
| Active Members | Total members with active status |
| Pending Invitations | Invitations awaiting acceptance |
| Administrators | Count of users with Admin role |
Two-Factor Authentication (2FA)
Kliper supports TOTP-based two-factor authentication for an additional layer of account security.Setting Up 2FA
Navigate to Security Settings
Go to Settings > Security. The Two-Factor Authentication section shows your current 2FA status.
Scan the QR Code
A QR code is displayed on screen. Open your authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or any TOTP-compatible app) and scan the code.If your authenticator cannot scan the QR code, click Enter manually to reveal the secret key as a text string.
Verify the Code
Enter the 6-digit code from your authenticator app into the verification field. Click Verify. The system confirms the code matches your secret.
Save Backup Codes
On successful verification, 8 backup codes are generated and displayed in a grid. Each code is an 8-character hex string (e.g.,
A1B2C3D4).- Click Copy to copy all codes to your clipboard
- Click Download to save them as a
.txtfile
Signing In with 2FA
After 2FA is enabled, sign-in requires two steps:- Enter your email and password (or use OAuth)
- Enter the 6-digit code from your authenticator app, or use one of your 8-character backup codes
Trusted Devices
After a successful 2FA verification, you can mark the device as trusted to skip 2FA for 30 days. Trusted devices are listed in Settings > Security > Trusted Devices with:- Device name and browser
- IP address
- Last used timestamp
- Expiration date
Disabling 2FA
In Settings > Security, click Disable 2FA. You must enter a current authenticator code to confirm. All backup codes are invalidated.Passkeys (Passwordless Authentication)
Kliper supports WebAuthn-based passkeys for passwordless sign-in using biometrics (Face ID, Touch ID, Windows Hello) or hardware security keys.Registering a Passkey
Check Browser Support
The platform checks if your browser supports WebAuthn. If not, a message indicates that passkeys are not available on your current device.
Click Add Passkey
Click Add Passkey. Optionally enter a name for the passkey (e.g., “MacBook Touch ID”). Your browser’s passkey dialog opens.
Managing Passkeys
Your registered passkeys are listed with:| Field | Description |
|---|---|
| Name | User-given name or “Passkey” (default) |
| Device Type | Platform (built-in biometric) or cross-platform (hardware key) |
| Backed Up | Whether the passkey is cloud-recoverable |
| Created | Registration date |
Signing In with a Passkey
On the sign-in page, click Sign in with passkey. Your browser prompts you to select and authenticate with a registered passkey. No password is needed.
Account Security Settings
Additional security options available in Settings > Security:Password Management
Change your password with real-time strength validation:| Requirement | Rule |
|---|---|
| Length | Minimum 8 characters |
| Complexity | Upper and lowercase letters, at least one number, at least one special character |
Session Management
| Setting | Description |
|---|---|
| Session Timeout | Automatic logout after N minutes of inactivity (1–1440 minutes) |
| Active Sessions | View all active sessions with device info, browser, and last activity time |
Appearance and Preferences
| Setting | Options |
|---|---|
| Theme | Light, Dark, or System (follows OS preference) |
| Compact Mode | Toggle compact UI layout |
| Animations | Toggle UI animations |
| Language | Interface language selector |
| Timezone | Timezone for displayed timestamps |
| Time Format | 12-hour or 24-hour |
| Week Start | Sunday or Monday |