User Management & RBAC

Kliper uses Role-Based Access Control (RBAC) to govern what each team member can do within your organization. Five built-in roles cover common access patterns; you assign one to each team member.

Roles and Permissions

Built-In Roles

These five are the system roles the platform recognizes (admin, manager, assessor, qa, viewer). QA is the review gate — identical authoring access to an Assessor, plus the ability to approve/reject findings.

Permission Matrix

The table below shows exactly what each role can do across every resource category:

Roles are a fixed set

Kliper’s roles are a fixed set of built-in system roles — Admin, Manager, Assessor, QA, and Viewer — chosen to cover QSA-firm workflows. You don’t create or edit roles; you assign one of these five to each team member (see Adding Team Members).

Settings > Permissions & Roles is a read-only reference: the Roles tab shows each built-in role and how many permissions it carries, and the Permissions tab lists the full permission catalog grouped by category. Use it to confirm exactly what a role can do before you assign it.

Adding Team Members

You can create someone’s account directly (fastest) or invite them by email to set their own password.

Create user (direct)

From the User Management page (/users), click Create user to add a member with no invitation round-trip. It’s a single-page form (no steps) — identity (name, email), access (role), optional details, and provisioning, with a live record preview that updates as you type. For the password, let Kliper auto-generate a strong one or set your own (minimum 12 characters).

Choose how credentials reach the new user with the Send welcome email toggle:

• On — the login details are emailed to them automatically.
• Off — the generated password is shown once in-app for you to copy and share securely.

Either way, admin-created accounts must change the password on first login — the shared credential is a bootstrap, never the permanent one.

Method 1: Invite by Email

Use this when the person does not yet have a Kliper account, or when you are unsure.

Method 2: Add Existing User

Use this when the person already has a Kliper account but is not in your organization.

Managing Invitations

The Team Settings page shows all pending invitations. For each pending invitation, you can:

• Resend — send the invitation email again (useful if the original expired or was missed)
• Revoke — cancel the invitation before it is accepted

Domain-Based Discovery

When a new user signs up with an email domain that matches your organization’s allowed domains, they can discover your organization and request to join. The organization’s Domain Join Policy controls this:

Managing Team Members

Viewing Your Team

Navigate to Settings > Team to see a table of all organization members:

Use the search bar to filter members by name or email.

Changing a Member’s Role

From the team members table, click the actions menu on a member’s row and select Change Role. Choose the new role from the dropdown and confirm. The role change takes effect immediately.

Removing a Member

Click the actions menu and select Remove from Team. A confirmation dialog appears. On confirmation, the user’s membership is deactivated and they lose access to all organization data.

Team Statistics

Three cards at the top of the Team Settings page summarize your team:

Enterprise Single Sign-On (SSO)

Kliper supports enterprise SSO over OpenID Connect (OIDC), so your team signs in with your existing identity provider — Okta, Microsoft Entra ID, Auth0, Google Workspace, or any standards-compliant OIDC provider.

How it works

• Identifier-aware login — when a user enters an email on an SSO-enabled domain, Kliper hides the password field and routes them to your identity provider.
• Just-in-time provisioning — first-time users who authenticate through your IdP are created automatically as members of your organization.
• MFA stays with your IdP — Kliper relies on your provider’s multi-factor and conditional-access policies (one-time codes, passkeys, biometrics) and doesn’t add a second prompt.

Setting it up

SSO is enabled by the Kliper team for your organization. Provide your OIDC issuer / discovery URL, client ID and secret, and the email domain(s) to route, and we’ll turn on identifier-aware login for those domains.

Two-Factor Authentication (2FA)

Kliper supports TOTP-based two-factor authentication for an additional layer of account security.

Setting Up 2FA

Signing In with 2FA

After 2FA is enabled, sign-in requires two steps:

1. Enter your email and password (or use OAuth)
2. Enter the 6-digit code from your authenticator app, or use one of your 8-character backup codes

Trusted Devices

After a successful 2FA verification, you can mark the device as trusted to skip 2FA for 30 days. Trusted devices are listed in Settings > Security > Trusted Devices with:

• Device name and browser
• IP address
• Last used timestamp
• Expiration date

Click Remove on any trusted device to revoke its trust status.

Disabling 2FA

In Settings > Security, click Disable 2FA. You must enter a current authenticator code to confirm. All backup codes are invalidated.

Passkeys (Passwordless Authentication)

Kliper supports WebAuthn-based passkeys for passwordless sign-in using biometrics (Face ID, Touch ID, Windows Hello) or hardware security keys.

Requiring 2FA for Your Organization

Organization admins on the Team plan (and above) can make two-factor authentication mandatory for every member of their organization.

Registering a Passkey

Managing Passkeys

Your registered passkeys are listed with:

Click Remove to delete a passkey. You can register multiple passkeys for different devices.

Signing In with a Passkey

On the sign-in page, click Sign in with passkey. Your browser prompts you to select and authenticate with a registered passkey. No password is needed.

Account Security Settings

Additional security options available in Settings > Security:

Password Management

Change your password with real-time strength validation:

A 5-level strength indicator provides visual feedback as you type.

Session Management

Kliper enforces a NIST SP 800-63B AAL2 session profile:

Click Logout on any active session to terminate it remotely.

Appearance and Preferences