Internal Access Control

Restrict which companies individual organization members can access using member-level or company-level assignment controls.

Overview

By default, all organization members can access all companies in the portfolio. Internal Access Control lets Owners and Admins restrict access so that specific members can only see specific companies. This is useful for organizations that manage multiple clients and need to limit visibility between teams or departments.

Accessing the Internal Access Page

Navigate to Organization > Members.
Click the Internal Access tab.

View Modes

The Internal Access page supports two perspectives, toggled with the view switch:

By Member (Default)

Shows a table of all organization members with:

Name -- The member's name and email.
Role -- Owner, Admin, or Member.
Access -- The member's access scope:
- All companies -- Full access to every company (default for new members and always true for Owners).
- Limited -- Access restricted to specific assigned companies.
- No access -- No company assignments (the member has no company access).
Assigned Companies -- The number of companies the member is assigned to.
Manage Access -- Opens the assignment dialog for that member.

By Company

Shows a table of all companies with:

Company -- The company name, with a "Shared" badge if the company was shared from another organization.
Members -- The number of members assigned to that company.
Manage Access -- Opens the assignment dialog for that company.

Managing Member Access

Assigning Companies to a Member

In the By Member view, click Manage Access for the member you want to configure.
A dialog opens showing a multi-select list of all companies in your organization.
Select the companies the member should have access to.
Click Save.

If you assign zero companies, the member will have no company access (shown as "No access" in the table). If you assign at least one company, their access scope changes to "Limited."

Assigning Members to a Company

Switch to the By Company view.
Click Manage Access for the company you want to configure.
A dialog opens showing a multi-select list of all non-owner members.
Select which members should have access to this company.
Click Save.

Owner Access

Owners always have full access to all companies. The Manage Access button is disabled for Owner-role members, and you cannot restrict their access. To limit someone's company access, first change their role to Admin or Member.

Searching and Filtering

Use the search button to filter the table by member name, email, or company name.
In the By Member view, filter by role (Admin, Member) or access scope (All companies, Limited, No access).

How Permissions Work

When a member's access is limited to specific companies:

They can only view and interact with their assigned companies in the portfolio.
They cannot see financial data, KPIs, or reports for unassigned companies.
Permission checks are cached for performance. After changing assignments, there may be a brief delay (up to two minutes) before the changes take full effect.

When a member has no specific company assignments (access scope of "All companies"), they can access everything in the portfolio. This is the default state for new members.

Permissions Required

Only Owners and Admins can access the Internal Access page and modify company assignments.

Next Steps

Managing Members -- Add, remove, and change roles for organization members.
Managing Invitations -- Handle pending member invitations.
Organization Settings -- Update your organization profile.

Managing Invitations

Subscription Plans