Important: roles are per-organization. The same person can be an Admin in one org and a Sales user in another.

Quick comparison

• Organization Admin: full control. Manages the org, team, integrations, billing, and compliance settings. Also has all Sales and Custodian capabilities.

• Sales: builds proposals, manages assigned clients, and sends documents for signature. Cannot manage the team, billing, or org-level settings.

• Custodian: manages installed/serviced accounts and accesses the Vault to view Authoritative Copies. Limited proposal and billing visibility.

Organization Admin

Admins run the org. They’re the only role that sees the full Settings page, including Organization Settings, Team Members, Integrations, Compliance, and Billing configuration.

What Admins can do

• Invite, remove, and reassign teammates; change roles.

• Edit org name, logo, timezone, and branding.

• Connect and disconnect integrations (Gmail, Outlook, Stripe, QuickBooks).

• Configure compliance settings, including vault PIN reset for other users.

• View all clients, all proposals, all documents, all invoices, regardless of assignment.

• Use every Sales and Custodian capability.

When to use it
Owners, operations managers, and office managers. Keep at least two Admins so you’re never locked out.

Sales

Sales users are focused on winning and closing business. They land on a Sales Dashboard tuned to pipeline activity rather than the standard admin dashboard.

What Sales users can do

• Create and edit clients they’re assigned to (or that they create).

• Build proposals: line items, pricing, recurring revenue, terms.

• Send proposals for client review and accept/decline tracking.

• Send documents for e-signature using templates or uploaded PDFs.

• Manage their personal email integrations (Gmail or Outlook) under My Preferences, so signed documents and proposals can send from their own address.

• See reports scoped to their own performance.

What Sales users cannot do

• Invite or remove teammates.

• Change org-level settings, logo, or branding.

• Connect org-wide integrations (Stripe, QuickBooks).

• Reset another user’s vault PIN.

• See clients or documents not assigned to them (unless your org allows broad visibility).

When to use it
Account executives, BDRs, and anyone who quotes and closes deals but doesn’t need to administer the platform.

Custodian

Custodians are responsible for the post-sale relationship. The installed and serviced accounts. They land on a Custodian Dashboard focused on their book of business and contract status.

What Custodians can do

• View clients assigned to them, including primary contacts and site info.

• Open the Vault to view Authoritative Copies of their accounts’ signed contracts (requires their personal vault PIN).

• View audit logs for those contracts.

• Use their personal email integration to communicate with assigned clients.

What Custodians cannot do

• Download or print Authoritative Copies. Custodians can view only. Download is reserved for working Copies and audit logs, per UCC § 9-105 controls.

• Build or send proposals.

• Send new documents for signature.

• Manage the team, integrations, or org settings.

• See clients or vaulted documents outside their assignments.

When to use it
Service techs with account responsibility, account managers for installed bases, and anyone who needs reference access to executed contracts without the ability to alter them.

How role-based access actually works

• Roles are stored in a dedicated user_roles table (not on your profile) so they can’t be tampered with from the client.

• After sign-in, Loyva routes you to the dashboard that matches your role (`/sales`, /custodian, or /dashboard).

• When you switch orgs, Loyva re-checks your role for that org and re-routes you. If your role changed since the page loaded, you may need to refresh.

• Vault access additionally requires a personal PIN, even Admins must enter their own PIN to unlock vaulted documents.

Frequently asked questions

Can a Custodian be promoted to Sales temporarily?
Yes, change their role to Sales for the project, then move them back when finished. There’s no cost difference, and historical records stay intact.

Why can’t my Custodian download a signed PDF?
By design. Authoritative Copies cannot be downloaded or printed by Custodians; this preserves the single-original status required for transferable records. They can request that an Admin or Sales user share a working Copy instead.

Can I create a custom role?
Not today. The three built-in roles cover the vast majority of security-alarm workflows. Tell support what you’re trying to do. It may already be possible with feature flags or assignment rules.

I’m an Admin but I don’t see the Sales Dashboard.
Admins land on the standard Dashboard by default. You still have every Sales capability, just navigate to Clients, Proposals, or Documents directly from the sidebar.