Skip to content
ESEN

Team, permissions, and security

Separate each user’s personal security from the rules shared by the whole organization.

Cord has three distinct access layers:

  1. Your account protects personal identity: password, 2FA, passkeys, sessions, and the connected Google account.
  2. Team and permissions decides what each member can do inside an organization.
  3. Organization security applies requirements such as 2FA, inactivity timeout, and allowed domains for invitations.

Plans and seats

Inviting a team and using custom roles start on Professional. The current included allowance is:

Plan Included users Additional users
Free 1 Not available
Starter 1 Not available
Professional 5 Monthly charge per user
Scale 15 Monthly charge per user
Developer Unlimited Included

A valid invitation already reserves a seat even if it has not been accepted yet. If the indicator is full, revoke an invitation you won’t use or review your plan. Additional user rates are in Your subscription.

Invite a person

  1. Open Settings › Team & permissions › Team & roles and select Add member.
  2. Enter their email.
  3. Choose Admin, Rep, Read only, or a custom combination.
  4. Review each permission and send the invitation.

The invitation expires after 7 days. Cord tries to send it by email and also returns a copyable link as a backup. Resend rotates the previous token and creates a new one valid for seven days; the old link stops working.

If the organization restricts domains, the email must end exactly in one of the domains configured under Settings › Team & permissions › Security. The rule also covers link-only invitations: it is checked when the invitation is accepted, against the email of the account the person signs in with, so an account from another domain cannot join even if it has the link. Each link works only once.

Roles and permissions

Roles are editable presets, not a replacement for effective permissions:

  • Admin: almost everything, including team; refunds are not enabled.
  • Rep: quotes, clients, products, and reports; no settings or approvals.
  • Read only: enters the app without modification permissions.
  • Custom: a combination saved specifically for that member.
  • Super admin: whoever created the account (the owner). Full access by definition; cannot be downgraded or revoked from Team.

The independent permissions are Quotes, Approvals, Collections, Clients, Products, Reports, Settings, Payment settings, Refunds, and Team.

Who can grant what:

  • The owner can grant any permission.
  • Anyone else with the Team permission can only grant the permissions they have themselves, whether inviting, editing a member, or choosing a role. What the member already had is kept even if the editor doesn’t have it, and removing permissions is always allowed.
  • Refunds can only be granted by the owner.
  • Nobody can change their own permissions or role: ask someone else who manages the team.
  • Resending a link-only invitation that grants permissions you can’t grant is up to the owner, because the new link comes back to you.

Hiding a button is not the security boundary. The APIs validate the permission and the active organization again before reading or modifying data.

Membership states

  • Active: accepted the invitation and keeps access.
  • Invited: the link is still pending; it may be valid or expired.
  • Revoked: no longer enters the organization. The record is kept to show history and the person can be invited again.

The screen shows last session, recent quotes, and last action when data is available. Revoking removes access; it does not automatically reassign or delete documents that person created.

Require two-step verification

Under Settings › Team & permissions › Security, turn on Require two-factor authentication (2FA) for the organization. A member who has not set up TOTP yet is sent to Settings › Your account to finish activation before continuing to use protected sections.

Personal activation happens under Settings › Your account: scan the QR code with your authenticator app, confirm the code, and save the ten single-use backup codes shown on activation. Store those codes outside Cord. Regenerating them invalidates the previous set. Disabling 2FA or regenerating the backup codes asks for your password and a code from your authenticator app; if your account has no password, just the code.

When you sign in, each authenticator code works only once and each backup code is spent when used. From the third failed code in a day, Cord sends you the email Sign-in attempt with your password (at most one per hour): whoever tried it typed your correct password, so change it if it wasn’t you. After ten failed codes in 24 hours, the second step is paused except from a network where you already have an open session; resetting your password lifts the pause.

When the organization requires 2FA, protection also applies to dashboard requests, not only to the visible screen. Actions needed to set up 2FA, confirm your identity, or sign out remain available.

If a sensitive action asks you to verify your identity again, complete it before retrying. Team permissions are still required; having 2FA does not grant permission to refund or administer the business.

Sensitive actions, such as changing the payout account, adding a person to the Cord Payments verification, creating an API key, turning on the verification code, or setting the first password on an account created with OAuth, ask you to confirm your identity if you signed in more than ten minutes ago. You confirm with the same thing your sign-in asks for:

Your account How you confirm
Has a passkey Confirm with passkey, with your fingerprint, your face, or the device PIN. That alone is enough.
Password and 2FA Your password and a code from your authenticator app or a backup code.
Password without 2FA Your password.
No password, with 2FA A code from your authenticator app or a backup code.
You sign in with Google or Apple, with no password or 2FA Continue with Google or Continue with Apple: a window opens so you can sign in again and, when you finish, the action continues.
You sign in only with SSO Sign out and sign back in.

Deleting your account or the organization and disabling SSO for one hour ask for the same thing in their own dialog.

Passkeys and password

Under Settings › Your account each person can:

  • create or change their password;
  • register several passkeys compatible with the device or key manager;
  • remove a passkey they no longer recognize;
  • connect or disconnect Google. Apple shows as Coming soon: it isn’t available yet.

An account created with OAuth can set a password later. Before disconnecting the last working method, confirm you keep another way to sign in.

Every new password, when you sign up, recover it or change it, must be at least 10 characters long, cannot contain your email and cannot appear in public data breaches. If your current password predates this rule, it still works for signing in; the rule applies the next time you change it.

Active sessions

The session list shows device, known IP, last activity, and which one is the current session. You can close an individual session or all the others.

The organization can also configure an inactivity timeout under Settings › Team & permissions › Security: unlimited, 1, 4, 8, or 24 hours. This rule is different from manually closing personal sessions.

The timeout is checked when entering the app, billing, and protected internal APIs, and also when registering a passkey. When it expires, the operation stops and you must sign in again. Activity is measured by authenticated requests to those surfaces, not by moving the mouse; automatic app requests may also count. Visiting a public page or using the 2FA recovery routes does not restart the window. “Unlimited” disables the inactivity timeout but keeps the maximum session lifetime, revocations, and account suspension.

Enterprise SSO

SAML 2.0 connections are administered under Settings › Team & permissions › SSO and require the Scale or Developer plan and the Team permission. A saved configuration does not guarantee access after losing that plan. The technical setup of the connection (Entity ID, sign-in URL, certificate, domains, provisioning, and role mapping) is in SSO & SAML.

Members managed by SSO are flagged in Team, and their permissions are managed by your identity provider.

Require SSO

Once a connection is working, you can require your team to sign in only through SSO.

  1. Under Settings › Team & permissions › SSO, confirm you have at least one Active connection with a verified domain. Without one, Cord rejects the change.
  2. Under Require SSO, turn on Require your team to sign in via SSO.
  3. Save.

With the option on, Cord blocks password, Google, Apple, and passkeys for every member except the account owner, who always keeps their password as a fallback.

Emergency access

If your identity provider is down and your team cannot sign in, the owner can temporarily disable the requirement:

  1. Under Settings › Team & permissions › SSO, select Disable for 1 hour.
  2. Confirm your password (or your verification code) and select Disable for 1 hour.

During that hour the team can use their other sign-in methods again, and the screen shows SSO temporarily disabled until the expiration date and time. When it ends, the requirement comes back on its own. Only the owner can use this option, and the action is recorded in the organization’s audit log.

Delete a personal account

The danger zone in Your account permanently deletes the personal identity, sessions, passkeys, and connected accounts. It requires a credential and typing the email to confirm. Without organizations of their own, the account is deleted right away. If that person is the sole owner of an organization with more members, they must transfer ownership first; if there’s no one else, that organization’s deletion is scheduled in 30 days and the account is deleted with it, with time to download the tax documents and cancel. Details in Data and deletion.

Common problems

I can’t invite. Check the Team permission, Professional plan or higher, an available seat, and an allowed domain.

The link expired. Use Resend; don’t try to recover the previous token.

I can’t grant a permission. You can only grant the permissions you have, and Refunds can only be granted by the owner.

The person can’t accept the link. If the organization restricts domains, they must sign in with an account from one of those domains.

The person signs in but can’t edit. Check the effective permissions, not only the role name.

The organization requires 2FA. The person must complete TOTP in their own account; an administrator cannot generate the codes for them.

“Too many attempts” when signing in. Ten failed passwords from the same device in 15 minutes pause that device for that long. If the attempts come from many places (30 in an hour), the account only lets you in from a network where you already have an open session. In both cases, resetting your password from the forgot-password link on the sign-in screen lifts the pause. Cord never says on screen whether an email has an account.

I got “Sign-in attempt with your password”. Someone typed your password and failed the verification code. If it wasn’t you, change it under Settings › Your account and sign out the sessions you don’t recognize.

Opening my organization asks me to sign in with SSO again. Your organization requires SSO and the session wasn’t opened with its identity provider (for example, you signed in through the SSO of another organization you also belong to). Sign in with this one’s.

I can’t turn on Require SSO. You need an active connection with at least one verified domain.

The identity provider is down. The owner can sign in with their password and use Disable for 1 hour.