TEAM & ROLES
Your whole team, with exactly the right access
Six roles over a 21-permission model, enforced in the database itself. Invite your accountant, your office manager, and your staff — each one sees precisely what their role allows, and nothing more.
Watch the Team page in action: an email invite goes out, the new member joins without a signup code, gets the accountant role, and every change lands in the audit log.
ROLES
Six roles that match how a business actually runs
Most tools give you admin or not-admin. Cove ships six roles — owner, admin, member, accountant, viewer, and custom — so access maps to real jobs instead of forcing everyone into full control. Roles are assigned per member and can be changed at any time.
Owner and admin
Full control of the workspace: members, settings, and every module. The owner role stays with the person who runs the business, and only it opens billing and deleting the organization.
Accountant
A finance-scoped role for your external or in-house accountant. They work in invoices, expenses, and taxes without touching the rest.
Viewer
Read-only access for anyone who needs to see the numbers but never change them — an investor, a co-founder, a controller.
Custom
Start from the 21-permission model and grant exactly what one person needs. The set is stored on the member, not on the role, and entire sections can be hidden from their navigation.
SECURITY
Access control enforced in the database, not the interface
Hiding a button is not security. In Cove, the six roles and their 21 permissions are enforced by row-level security on every table: reads are scoped to the workspace and writes are permission-checked in SQL. Even a bug in the interface cannot leak another member's restricted data.
Row-level security on every table
Each query runs as the signed-in member. The database itself refuses reads outside the workspace and writes outside the member's permissions.
Nobody grants what they do not hold
A database trigger compares the permissions being granted against the granter's own. An admin cannot promote themselves to owner, nor hand a teammate a permission they do not hold.
An audit log on 60+ tables
A trigger records every change — who made it, on which table, which record, which fields, and the values before and after. Tokens and keys caught in the row snapshot are stripped on the server and never reach the browser.
Same rules for API and AI
API keys and MCP tools see only what their scopes and the member's role jointly allow. There is no side door around the permission model.
Download all my data, without writing an email
The right of access and portability under GDPR art. 15 and art. 20 is a button in the app. It does not sit behind a plan: art. 12(5) requires the response to be free of charge, so the door is guarded by permissions and frequency, not by price.
- 01
You pick the scope
The whole organization, from Settings, requires the data-read and organization-management permissions together — in practice an owner or an admin. My data, from Profile, is open to any member but only for themselves: no permission in the organization opens someone else's personal package.
- 02
Cove collects the records — and the files
One machine-readable NDJSON file per table. The whole-organization scope also carries the stored documents themselves. A personal package does not carry the organization's books: they hold third parties' personal data (GDPR art. 15(4)).
- 03
Credentials are stripped
Key hashes, signing secrets, connected-mailbox tokens, and invite hashes come out nulled — including inside the row snapshots the audit log keeps. A personal trail carries the moment, the action, the table, the record, and the names of the changed fields, but never the snapshot itself.
- 04
You download it
A notification when the package is ready, and a short-lived signed link to each part. The manifest lists the tables, their row counts, and every table deliberately left out with its reason. The package stays for seven days, and a new one for the same scope can be requested once every 24 hours.
Everything on the Team page
The controls you reach for weekly, all in one place.
Email invites
Hashed invite tokens, role picked up front, and no signup verification code for the invitee.
Company switching
One account can belong to several companies — switch between them without logging out.
Per-member custom grants
Grant or revoke any of the 21 permissions for a single member, independent of their base role.
Hidden sections
Remove entire modules from a member's navigation so their workspace shows only what concerns them.
Audit log
A chronological record of changes across 60+ tables, filterable by author, table, and action — from the Team page on Accounting and up, and as an Activity tab on a client or product record.
Two-factor sign-in
TOTP from an authenticator app or a code by email, on top of email-password or Google sign-in. Email codes are stored only as a hash, compared in constant time, and exhausted after five attempts.