Workspace admin guide

Add, invite and temporary passwords

Open Settings → Users to manage your workspace team. Choose the least privileged role needed; platform user management is not part of this guide.

Invites and temporary-password creation depend on enabled operational delivery. A temporary-password user must set a new password before entering the dashboard. Password completion clears the forced-change state; the old password cannot be reused.

1. Verify the workspace and recipient.
2. Choose the role and supported add/invite action.
3. Review the action and complete fresh verification if prompted.
4. Confirm the resulting membership; never share credentials in a support ticket.

Deactivate, MFA recovery and custom roles

Deactivate access rather than deleting business records to remove a team member. Review owned contacts and outstanding approvals before changing responsibilities. Reactivate is available for deactivated memberships; restoring a deleted membership is not yet available.

Password resets and MFA resets are distinct. Verify the person through your approved recovery process before resetting MFA, then require re-enrollment. Self-service recovery codes are not currently available; never treat an email link or recovery code as authenticator verification. Owner changes require an existing owner and fresh two-factor verification; at least one owner must remain.

Custom roles should grant only necessary screens and data scope. Test restricted contact ownership and export permissions with the intended role; a hidden navigation item is not a security boundary.

Mandatory 2FA, lockout and sessions

Require authenticator verification for sensitive administration. Fresh verification can be requested even after sign-in; complete the named action rather than attempting to bypass the prompt.

Use Security settings to review sessions and revoke unfamiliar access. Lockout is a protection against repeated failed attempts; follow the documented recovery process and audit the result.

IP allowlist and audit log

Validate your current access path before tightening the workspace IP allowlist. A mistaken rule can block your team; retain a documented authorized recovery process.

Audit logs record sensitive changes. Review actor, workspace, action and time when investigating. Export only to approved recipients and keep API keys, verification codes and personal data out of support descriptions.

SPF, DKIM and DMARC

In Settings → Sending domains, add a domain you own. Copy the provider-specific DNS records exactly into your DNS service; avoid creating multiple SPF policies at the same name.

Run the domain verification action after propagation. Verification checks ownership and provider status, not just the appearance of a record. Choose only verified workspace sender identities; a missing verified fallback holds marketing rather than routing through operational mail.

1. Add the domain and inspect its required records.
2. Publish the exact SPF/DKIM records and your reviewed DMARC policy.
3. Verify the domain with fresh administrator verification.
4. Inspect its status before selecting it for campaigns.

BIMI

Available on request / setup required. BIMI setup is available on request / setup required; its rollout flag is OFF.

BIMI requires suitable DMARC enforcement, a compliant logo and any certificate required by the mailbox provider. DNS presence alone does not guarantee logo display. Use the supported Tiny-PS logo validation; never paste arbitrary SVG into messages.

Dedicated IP, warm-up and seed placement

Available on request / setup required. Dedicated IP, warm-up and automatic seed placement require setup and separate activation. Automatic seed placement remains OFF.

Dedicated IP assignment depends on your provider account. Use an approved warm-up plan tied to legitimate opted-in audiences; increasing volume cannot manufacture sender reputation.

Seed-inbox placement reads configured TLS mailbox connections with bounded token/window searches. It does not guarantee inbox delivery or automatically retry sends. Manual tests are protected send actions, not previews.

Postmaster and SNDS

Verify ownership in the applicable mailbox-provider monitoring service. Compare its complaint/reputation signals with OmniReach delivery reports; differences in coverage and timing are expected.

Use observed evidence to investigate and reduce risky sending. Do not claim mailbox-provider endorsement or guaranteed delivery from a verified domain.

Consent ledger and preference centre

Retain the source and purpose of consent. Public signup never overrides an existing opt-out. Confirmation and unsubscribe links are scoped to the workspace and contact; preferences do not remove global transport suppression.

Configure preference topics with clear descriptions. Review frequency caps and quiet hours for the audience time zones; these controls limit eligible sends rather than grant permission.

Requests, breach register and retention

Use the privacy toolkit to record data-subject requests, review identity and scope, and track your response. Exports and deletion must respect workspace ownership and authorization.

Record breach decisions and retention policies with accountable owners. Records of processing describe purpose, data categories and retention. These tools support compliance work; they do not establish legal compliance or replace legal review.

Plans and card payments

Available on request / setup required. Stripe / Airwallex card payments are available on request / setup required; providers are not enabled.

Global workspaces show USD. Check the current Pricing page and Billing screen for the canonical plan limits rather than treating this guide as a price schedule. Trial length and plan are set per approved request on the activation key, not by this guide.

Use Contact sales when payments are not configured. Never put card numbers or bank details into tickets or custom fields.

VisionX trial workspaces

Trials are activated with a single-use VisionX key at /trial/activate. The requester sets a password, enrols two-factor authentication, and becomes the workspace administrator of a new Global (USD) workspace.

Trial guardrails are enforced by the database, not just the interface: a daily email allowance (default 200), no campaign sends until the workspace’s own sending domain passes SPF/DKIM/DMARC, SMS/WhatsApp disabled, a required consent attestation before importing contacts, and automatic sending pause when bounce or complaint rates cross the configured thresholds.

When a trial ends the workspace becomes read-only; data is kept, not deleted. A platform super-administrator can extend a trial with fresh two-factor verification.

Invoices, statements and dunning

Billing displays available invoice records and download actions. Global invoice identity resolves to VisionX LLC; historical issuer and currency snapshots are preserved. An empty history means no invoice is available, not that the guide creates one.

A failed payment can enter the configured reminder/grace workflow and eventually restrict writes. Inspect the subscription state before retrying checkout. Never alter a prior invoice to match a new account setting.

Profile-specific agreement acceptance and new document-version workflows remain unavailable while their rollout is held; readable Global legal links are drafts pending legal review.

API keys, OAuth and webhooks

Create narrowly scoped workspace credentials in API keys and store them in your approved secret manager. Rotate compromised keys and verify connected systems use the replacement. Never place private keys in browser code.

Review OAuth scopes and the intended account before connecting. Webhook consumers must verify the documented authentication/signature contract. Test with sandbox events, not customer sends.

Warehouse export and Parquet

Available on request / setup required. Warehouse scheduled delivery and Parquet need setup/rollout approval. Snowflake Parquet delivery is not available; no new job is created by opening the export screen.

Select the permitted export data and verify the destination, credentials and mappings. Files must retain workspace scope and privacy limits. Warehouse reconciliation is not permission to resubscribe contacts.

Parquet preserves authorized export projections; delivery depends on the approved destination adapter.

Shopify, Wix, helpdesks and CRM

Available on request / setup required. Shopify/Wix installs, CRM providers and external helpdesks require authorized setup. Per-user CRM OAuth and external ticket delivery remain gated.

Configure provider credentials, callback registration, scopes and mappings before enabling sync. Review source ownership: one integration must not remove another source’s tags or list memberships.

HubSpot/Salesforce fields must pass the connection’s supported mapping checks. Helpdesks use explicit field mappings and do not receive consent/suppression fields. Use the connection error state to diagnose failures rather than adding duplicate connections.

Workspace branding and partner access

Available on request / setup required. Partner onboarding, white-label entitlement and applications are available on request / setup required; application rollout remains OFF.

Workspace branding controls company identity in your own campaign content. Verify legal/contact details and Reply-To; changing branding does not alter sending-domain eligibility.

White-label options depend on the approved tier and partner configuration. Global partner terms are VisionX LLC Delaware drafts pending legal review; no acceptance is available while the agreement/document rollout is held.

ISO 27001 / SOC 2 readiness controls

Available on request / setup required. Trust register is available on request / setup required; its rollout flag is OFF.

The readiness register organizes controls, evidence, owners, gaps and access reviews. Evidence should describe actual controls and their operating period; review it before sharing externally.

Readiness is not certification, an audit opinion or a claim that OmniReach is ISO 27001 or SOC 2 certified.

Export, retain and close

Export only records your role can access and validate the file before requesting closure. Contact CSV exports and individual data-subject JSON exports are scoped reports, not complete workspace backups. General JSON/Parquet conversion remains unavailable while its rollout is OFF. Document retention obligations and permitted recipients; deleting access is different from deleting records.

Review subscription cancellation, connected credentials, pending reports and partner obligations with the responsible administrator. Use the authorized closure/support process; never assume signing out closes an account. Deleted contacts cannot be restored from the interface; review and export authorized records before deletion.