Skip to content
Docs

Self-hosting

Team access and account managers

Roles, managers restricted to the partners and advertisers assigned to them, moving a manager's book, and the email on sign-in from a new browser.

Who may do what is set by roles (Settings → Team & roles). Each role is a matrix of read and write permissions per area plus special actions (approve conversions, manage billing, export, impersonate). This page covers the two account controls on top of that: managers who only see their own accounts, and the alert when someone signs in from a new browser.

Restricted to assigned accounts

Give a role the special action Restricted to assigned accounts and every member with that role sees only the partners and advertisers assigned to them:

  • a partner is theirs when they are its account manager or account executive;
  • an advertiser is theirs when they are its account manager or sales manager;
  • an offer is theirs when its advertiser is theirs, or when they are the offer's account manager.

Everything that belongs to those accounts follows: offers, goals, landing pages, creatives, payouts, caps, postbacks, applications, conversions and clicks, reports, the funnel, raw logs, invoices, statements, payouts, prepaid wallets, notes, audit history, exports and scheduled reports, search, API keys and MCP tokens they create, and the in-app assistant. A row is visible when at least one partner, advertiser or offer it belongs to is in the manager's book, so a conversion of one of their partners on another manager's offer is visible, with that offer's id.

Enforcement is on the server, in one place: a Postgres row-level security policy on every table that belongs to a partner, advertiser or offer, switched on for the request of a restricted member. The reporting service applies the same rule to every ClickHouse query. The SKU and fail-traffic reports are limited to the book too. Prepaid wallet top-ups can be booked for advertisers in the book when the role may write billing (the built-in manager role may not). Report families that are not split by partner or advertiser (mobile cohorts, SKAN, lead-gen, iGaming, call reports) and tenant-wide tools (data locker, scheduled offer import, firehose) are not available to restricted members.

A restricted member cannot edit roles or team members (that would lift the restriction). A partner or advertiser they create is assigned to them. Moving one of their accounts to someone else is refused, because it would leave their book.

Assigning managers

  • One account: set the manager fields on the partner or advertiser (Edit).
  • Many accounts: select rows in the partner or advertiser list and use Assign manager in the bulk bar.
  • A whole book: on Settings → Team & roles → Account managers, Move book hands every partner and advertiser of one manager to another (for example when someone leaves). Each change is written to the audit log.

The API is POST /account-managers/assign (kind, field, ids or from_employee_id, employee_id); GET /account-managers lists every member with the size of their book; GET /me/account-scope tells a member whether they are restricted and how many partners, advertisers and offers they see.

New sign-in alerts

When an account signs in from a browser it has not used before, its owner gets an email with the browser, operating system, IP address and time, and a link to their sign-in list. This applies to staff, partner and advertiser users alike. The first browser a user ever signs in with is recorded without an email; staff opening a partner or advertiser portal for support does not trigger it.

Each user can turn the email off, and forget browsers, under Security (admin: Settings → Security, partner portal: Account → Security, advertiser portal: Security). The email is a system email (Communication → System emails → New sign-in) translated in every portal language, and every new browser is written to the audit log as auth.new_browser.