Administrator Guide · A3

Users, security & logging in

In this chapter - Logging in and choosing a database - Signing in to the web portal (client.techiecrm.com): forgotten passwords, timeouts, "keep me signed in", signing out - Users in TechieCRM - Disabling a user, on the desktop and on the web portal (users are never deleted) - User-management rights: what they now gate - Access rights that are enforced today, including what unticking Read in the web portal's Security Groups now does - The Administrator window - Not yet available

Logging in

The desktop sign-in window and the local portal's sign-in page now look and work the same (the portal has the same SQL / Mongo switch, SQL first, and the same gear; Administrator Guide A13):

Part	What it does
SQL / Mongo switch (top)	A rocker switch: SQL signs in to your office's SQL Server database, Mongo to TechieCRM's MongoDB database. The side that is on is filled with your theme's green. A side that cannot be used on this computer is greyed; hover it for the reason (No SQL Server database is set up yet. Use the gear to set one up., or the MongoDB reason). The window opens on the side you used last time.
Gear (beside Database Server)	Replaces the old … button. Hover it: Database configuration: set up the SQL Server and MongoDB database connections used to sign in. It opens the Configuration window on its Database page (A14), where you find, test, save and prepare a database before anyone has signed in. What you save or open there fills this window. On a computer that still needs setting up (no real licence, the 7-day trial included; no saved database; or, the first time, no link) the Configuration window opens over this window by itself, on its Licence page (A14, When the window opens by itself); it replaced the first-run setup wizard.
One ID field	Has no label above it: the grey tip inside the empty field says what goes there, and changes with the switch. With SQL it reads TechieCRM Email ID or CRM User ID: type either your TechieCRM ID (your email address) or your CRM user ID. An `@` means a TechieCRM ID. With Mongo it reads TechieCRM Email ID, and only a TechieCRM ID works: a CRM user ID gets A CRM user ID signs in to the SQL database. Choose SQL, or sign in with your TechieCRM ID. Rest the pointer on the field to see the same words once you have typed in it.
Password field	No label either: its grey tip reads Password, with SQL and with Mongo.
Login	Green, like the portal's Log in button. Cancel stays grey.

Every colour comes from your theme and changes with it (Theme, Primary and Accent in Settings).

Signing in to SQL with your TechieCRM ID (October 2026)

With SQL chosen you can now type your TechieCRM ID and its password instead of your CRM user ID. TechieCRM checks the TechieCRM ID (with the TechieCRM cloud, or with the sign-in this computer remembers when you are offline), then signs you in to the office database as the CRM user ID linked to it:

Linked, with your CRM password saved in your Credential Storage Manager: you are signed in straight away, no extra window.
Otherwise a second window, Link your CRM user ID, asks "Enter your CRM user ID and password for ." It says which TechieCRM ID was accepted and which database you are signing in to. * If your link is already known, the CRM user ID is shown filled in and greyed; press Use a different CRM user ID to type another. * If a saved password stopped working, the window says There is a problem with the CRM user ID or password. and asks for it again. * Press Sign in. TechieCRM checks the CRM user ID and password with your office database, links your TechieCRM ID to that CRM user ID (both passwords were just proved, see How a link is made and kept below), and signs you in. A wrong password keeps the window open with the reason; Cancel goes back to the sign-in window. * Save in my Credential Storage Manager: tick it to keep the CRM password as an Office database login (encrypted, Personal, yours only) in your Credential Storage Manager, so next time your TechieCRM ID is enough. This works whether your office keeps its records in SQL or in MongoDB: it needs a TechieCRM cloud subscription, your TechieCRM ID, and TechieCRM's database on this computer or your office server. The tick starts unticked (you choose to save); when a password is already saved for this database it starts ticked, so the new one replaces it. When the manager cannot be used, the window says so (for example Your CRM password is asked each time you sign in. Credential Storage Manager needs a TechieCRM cloud subscription.) and the password is asked each time. It is never kept anywhere else: not in the link, not in the office database, not in the app's settings. * Forget the saved password (shown when a password is saved for this database): removes your saved Office database login. Your link is not changed (a link changes only when both passwords are proved); the window then asks for your CRM user ID again. The local portal's second step has the same link with the same words.
If the CRM user ID is already linked to someone else you see who holds it, with Enter your own CRM user ID, or ask your administrator., and you are not signed in. If your TechieCRM ID is already linked to a different CRM user ID (since 24 October 2026, one TechieCRM ID links to one CRM user ID) you see This TechieCRM ID is already linked to the CRM user ID ANN. A TechieCRM ID links to one CRM user ID only: remove that link first ... and you are not signed in. Remove your link first (Remove my link on the Configuration window's Linked CRM logins page, A14), then sign in with the other CRM user ID. Signing in with the CRM user ID itself is not affected.
A database that has not been prepared for TechieCRM yet (the first sign-in to a freshly restored database): you are signed in, and the link is made in the same sign-in, a moment later, once TechieCRM has finished setting the database up and given it its workspace ID. You are not asked again (since October 2026, Stage C4; before that the link waited for the next sign-in). Nothing is said when it works.
If the link still could not be kept (your CRM user ID may not create tables, so the database could not be given its workspace ID; or your TechieCRM account could not be identified because this computer has never signed in online), you are still signed in and a message says why, once. An administrator can prepare the database in the Configuration window (Database page) and you can then link yourself on its Linked CRM logins page (Administrator Guide A14), or simply sign in the same way again.

The office can turn this off (October 2026). Let TechieCRM IDs sign in to SQL Server with a linked CRM login is one setting for the whole office, kept in the office database and followed by every desktop and the local portal. When an administrator has turned it Off (Configuration window ▸ Linked CRM logins, A14, The office-wide sign-in setting; or the local portal's Config database), a TechieCRM ID with SQL chosen gets In this office a TechieCRM ID cannot sign in to SQL Server: an administrator turned it off. Sign in with your CRM user ID, or choose MongoDB. after its CRM user ID has been checked, and nothing is saved. Sign in with the CRM user ID itself instead. It is On unless an administrator turned it off.

After signing in this way the session is exactly a CRM user ID session: the same records, the same rights, the same "switched off by an administrator" check. TechieCRM also knows which TechieCRM ID you are, and the next sign-in window shows your TechieCRM ID again.

MongoDB and an unlinked TechieCRM ID. Until October 2026, a TechieCRM ID signing in with Mongo that matched no CRM user acted as the last user who signed in, or as MASTER. That handed a person someone else's records, so it is gone: TechieCRM now says Your TechieCRM ID ... is not linked to a CRM user ID in this database ... Choose SQL and sign in with your TechieCRM ID once: TechieCRM then asks for your CRM user ID and links the two. Or ask your administrator to link them. and does not sign in.

Signing in without the internet (October 2026)

Every person in your TechieCRM workspace can sign in with their TechieCRM ID on any computer that runs on your office's licence, even when the internet is down and even if they have never signed in on that computer before. Network trouble should never keep a licensed person from their CRM data.

How. When the computer's licence connects to your workspace, TechieCRM downloads the list of the workspace's people (their TechieCRM IDs and the same one-way password check the TechieCRM cloud uses; never a readable password) and keeps it sealed with this computer's own key. It is brought up to date at every check-in and every online sign-in. Someone removed from the workspace, or whose login is switched off, is dropped at the next refresh; a computer that stays offline keeps the list it has. The workspace's customers (client portal logins) are never on it.
Too many wrong passwords. Five wrong passwords for one TechieCRM ID within 15 minutes, while offline, lock offline sign-in for that ID for 15 minutes: Too many wrong passwords for this TechieCRM ID on this computer. Try again in ... minutes, or connect to the internet. Online, the TechieCRM cloud applies its own limit.
Forgot password? is not available offline: your TechieCRM ID is your TechieCRM cloud account, and its password is reset there.
The local portal on the same computer uses the same list and the same lockout.

Choosing the database: the gear and the Configuration window (October 2026)

Login credentials: below the switch are four fields: Database Server, Client Database, your ID and Password. Server and Client Database are chosen with the gear button (green like Login, in your Primary colour), which first asks for your TechieCRM ID (to load your office's licence, database settings and linked CRM login; Continue without signing in skips it) and then opens the Configuration window on its Database page (Administrator Guide A14). It replaced the Open Database Server dialog in October 2026 and keeps its list, now called Available client databases: the databases you have used before, your last sign-in always included. On the Database page you can:

pick a SQL Server or MongoDB that TechieCRM found on this computer or your network, or type one;
with a SQL login and its password, list the databases (click the Database list) and Test connection without signing in;
Save a database: the sign-in window is filled with its server and database (and the CRM user ID you typed there); no password is kept;
Prepare a database that does not have TechieCRM's tables yet (A14, A12);
Open a database from Available client databases: the sign-in window is filled and the Configuration window closes; Remove takes one off that list (nothing in the database changes);
in MongoDB, list the databases (TechieCRM ones are marked), create a New... one, or use another MongoDB server.

Close the window with Close to come back to the sign-in window. The last server/database/user are remembered (never the password), and every successful login is saved to the list. Errors are specific (invalid user id, wrong password, cannot access database, server unreachable) and return you to the field. Spaces accidentally copied in front of or behind the User ID are ignored, so a pasted id is not rejected as invalid for whitespace alone. If the server drops after login you get a friendly retry.

Which theme the login window uses (October 2026). The login window opens in the theme of the last person who signed in on this computer: their Dark, Light or System choice from Settings ▸ Theme (see A5). System means it matches your computer's own light or dark appearance. When nobody has signed in on this computer yet, or that person's theme cannot be read, the window matches your computer's appearance. After you sign in, your own theme applies everywhere. Signing out, or choosing Sign in as a different user…, shows the login window in the theme of the person who was just signed in. Everything in the window follows the theme: the background, the SQL / Mongo switch, the four fields, the gear button and the Login and Cancel buttons. If the window is set to follow your computer and you switch your computer between light and dark while it is open, it changes with it.

The windows before the login window use the same theme (October 2026). TechieCRM can show a few windows before you reach the login window: the beta build notice, a build that has expired or must be updated, setting up TechieCRM's database on a first launch, licence activation and the Configuration window that opens over it on a first launch (it replaced the first-run setup wizard). All of them open in the same theme the login window will use (the last person's Dark, Light or System choice, or your computer's appearance when nobody has signed in yet), so nothing flashes from light to dark on the way in. While that theme is System, switching your computer between light and dark changes these windows too. Once you sign in, your own theme applies. The Administrator program does the same before its login window.

Forgot password? on the login window (October 2026). When the login window signs in with your TechieCRM account (MongoDB mode, see Choosing the database type at login below) a Forgot password? link appears to the left of Login. Press it and TechieCRM opens the TechieCRM password reset page in your web browser; the steps from there are the ones in Forgot your password? below (type the email address you sign in with, press Email me a link, then follow the emailed link). The page cannot be filled in for you, so the message TechieCRM shows names the address to type. Then come back to the login window and sign in with the new password.

The link is only shown for a TechieCRM account. A Source CRM (SQL) login has no Forgot password?: that password belongs to your office's database, and your administrator changes it.
TechieCRM never sends, saves or records your password for this; it only opens the page.
No internet connection: TechieCRM says so and opens nothing. Connect and press the link again. Your current password still signs you in here while you are offline, if you belong to this computer's TechieCRM workspace (see Signing in without the internet below). Resetting it needs the internet: it is your TechieCRM cloud account.
If no web browser opens, the message shows the address of the reset page so you can open it yourself.
The Sign in to TechieCRM window used to activate a licence (see Cloud Connection) has the same Forgot password? link, to the left of Sign in, and it works the same way.

What this computer can open (September 2026; on the Configuration window since October 2026). When the Configuration window opens it checks (without connecting to anything) which databases can be used here, greys out the one that cannot, and says why (hover the greyed side of the SQL / Mongo switch under Connect to for the same reason):

Database	Greyed out when	What you see instead
MongoDB	No MongoDB is configured: TechieCRM's database engine was not installed (an Advanced install can leave it out) or is not set up yet, and no other server is saved in Settings ▸ Local Database ▸ Connect to another MongoDB server.	TechieCRM's database engine was not installed … with where to connect another server. The Database list and Test connection wait for an address you type; nothing tries to connect, so there is no wait. If the sign-in window was on Mongo, the page opens on SQL.
SQL Server	ODBC Driver 18 for SQL Server is not installed; no SQL Server can be opened at all.	The driver's name and how to install it, on the greyed buttons. Available client databases is still shown, but Open is disabled.

When the ODBC driver is installed, SQL Server stays available even if no server was found: a server behind a firewall, or with the SQL Server Browser service turned off, cannot be discovered but can still be typed in Server. Found on this computer and your network lists SQL Server instances installed on this computer (Windows), servers you have saved, and servers that answered on your local network (the look takes a few seconds and runs in the background; Refresh looks again).

New... (MongoDB, beside Test connection) creates a new, empty TechieCRM database on this computer's MongoDB server: type a name (letters, digits, _ or -; the MongoDB system names and tenant_… are refused), and it appears in the Database list, selected, ready to Save. It is offered only after the Database list has read this computer's MongoDB (Address empty); it never touches an existing database; a name already on the server is refused.

At Login, the same checks run again: a MongoDB sign-in with no MongoDB configured, or a SQL sign-in without the ODBC driver, is stopped with the reason instead of a connection error.

main.py starts the CRM; administrator.py starts the Administrator window with the same login; inside the CRM, Setup ▸ Administrator opens it on the current connection.

Signing in to the web portal (client.techiecrm.com)

Your cloud workspace uses your email + password (set from the invitation link).

Your invitation link

When your workspace is approved you get an emailed link that lets you choose a password. It works once, and it stays valid for 14 days. If it doesn't work, the page tells you which of the three ordinary things happened, and what to do:

What the page says	What happened	What to do
This invitation has already been used	The password was set, usually by you, earlier.	Click Sign in. Forgotten it? Press Forgot password? there (see below).
This invitation link has expired	It is more than 14 days old. Nothing is lost; the workspace is still there.	Click Ask for a new invitation; an administrator re-issues it.
This invitation link is incomplete	Only part of the link opened; some email programs split long links across two lines.	Go back to the email and copy the whole link, or ask for a fresh one.

Administrators: Admin Portal ▸ Registrations has both Resend invite and Show invite link (the second is the fallback when the email doesn't arrive; pass the link on securely). "Show invite link" is only offered while the person has not yet set a password.

Forgot your password?

On the desktop app's login window in TechieCRM account (MongoDB) mode, Forgot password? opens this same page in your browser (see Logging in above), so start at step 2.

On the sign-in page press Forgot password?.
Type the email address you sign in with and press Email me a link.
Open the email from TechieCRM and press Choose a new password.
Type the new password twice and press Save new password, then sign in with it.

The page after step 2 always says "If that address has an account, we've sent a link", whether or not the address has one. That is deliberate: it stops a stranger finding out who has an account. If no email arrives within a few minutes, check your spam folder and that you typed the address you sign in with.
The link works once, within 60 minutes. It also stops working as soon as you sign in or your password changes, so always use the newest email. A link that no longer works says so and offers a new one.
The new password follows the same rules as any other: at least 8 characters, not a common password, not all numbers, and not too close to your name or email.
Saving the new password signs you out everywhere else on the web, and TechieCRM emails you "Your password was changed". If you didn't do it, contact us straight away.
You can ask for a link 3 times an hour for one address (10 times an hour from one network). After that the page asks you to wait an hour.
No link is sent for an account that is disabled, or that has never set a password (an invitation not yet accepted: ask for a fresh invitation instead). TechieCRM's own staff and administrator accounts can't use it either; the owner is emailed that someone asked, and another root administrator sets the password.
An account locked after repeated wrong passwords stays locked after a reset; contact us to unlock it.
Where it isn't offered: while outgoing email is switched off, the sign-in page says to press Help instead. On a TechieCRM server your company runs itself (the local portal) there is no Forgot password? link; ask the person who looks after that server.
Administrators: every completed reset is in Admin Portal ▸ Audit Log as a Password Change entry by that user. Requests are recorded too, with no user named (anyone can type an address), so only TechieCRM's own administrators see those. The link itself is never recorded.

Staying signed in, and signing out

Idle timeout (default). For security you are signed out automatically after 15 minutes of inactivity. Every click or keystroke extends the session; one minute before the limit the app shows a "Still there? … Stay signed in" prompt. If you come back later you'll see "you were signed out after 15 minutes of inactivity" on the login page; just sign in again and you return to the page you were on.
Keep me signed in on this computer (checkbox on the login form) keeps you signed in on that browser for up to 14 days of use (still sliding: two weeks without a visit ends it), and remembers your email on the login form. Only tick it on your own computer.
Sign out: from your name/menu (top-right) in the CRM, or the Sign out link on techiecrm.com when you're already signed in. The sign-out page has "Forget my credentials on this computer" (unticked by default): ticked, it clears your saved email, any "keep me signed in" and everything TechieCRM stored in that browser. Always tick it on a shared or public computer. Untucked, the login page keeps your email prefilled next time.
Passwords are never stored in the browser by TechieCRM (only your browser's own password manager, if you choose to use it).
One place at a time. Once TechieCRM switches it on for your workspace, your ID can be used in one place at a time; signing in somewhere new asks whether to sign the other place out. See Signing in from more than one place.
You may be signed out because your ID started being used on another device; the signed-out page says which one.

Users

The source CRM's login users appear in the Clients list under the organization row (your own company; both have their own icons: a building for the organization, and a person for each login user, with a small key mark on the icon for logins that hold administrator (user-management) rights). View ▸ Filter ▸ Users shows only them and switches the list to the *Users column setup (Name / Position / Company / Email Address / Phone 1 / City, created the first time; user rows fill whatever column setup is active by column name). Selecting a user drives the two lower panels like a client would: Related lists the organization row and the other users (open one to see it; the organization row opens the org chart), Interactions lists what that user owns: their notes, documents and e-mails, their To-Do tasks and the meetings on their calendar. Right-click a user: Open (User Properties) opens a client-style dialog (field names as placeholders and tooltips, two rows of tabs): General (name/position, company/address, internet, phones), User-Defined Fields (live), Activities (the user's tasks and meetings, with the same filters/actions as a client's Activities), Access Rights (the user's effective rights per module (read, insert, modify, delete) as the source CRM computes them; read-only), Groups / Teams (the security groups the user belongs to), Windows Authentication (not available); Message… (opens a conversation with that user), Org Chart (users nested by Reports to), Disable Login / Enable Login (see below), Change Password… (October 2026: opens the same Change Password window as your own name menu, top right, and the Administrator's Manage Users, for that login. On your own row anyone can use it; changing another user's password is for administrators only (user-management rights, the same as Disable Login, and the same rule as Administrator ▸ Manage Users ▸ Change Password…), and otherwise TechieCRM explains why it is blocked and the window does not open. The window still asks for that login's current password), Preferences… (not built yet; it says so, and each user changes their own preferences in Settings), Add User… (opens the form; creation itself stays in the source CRM's Administrator; see below). There is no Delete on this menu; see Disabling a user login. User display names everywhere come from the source CRM's user details. From the Clients list the dialog is view-only; editing is done in the Administrator's Manage Users (A4).

Who appears in the user lists (October 2026)

Every user dropdown that switches between your own list and a colleague's (My Calendar, My To-Do, My Messages, Show My Activities), plus the Calendar's Users, Locations and Resources and Free Time lists, the To-Do dialog's Assigned to, the New message to a user picker and the Activity Log's Who, now show the same people, in the same order:

only real logins: a user record in the source CRM's user table. An id that only appears on old records (someone deleted long ago, a typing slip) is never offered;
not the source CRM's own system accounts (COMPANY, WEBUSER, EMAILUSER, ADMINISTRATOR), its security groups, or its location and resource slots (LOCDFLT1, RESDFLT4, the free-form location L@FREEFORM): those are bookings and scopes, not people;
not a login an administrator switched off with Disable Login (a login switched off for the web only still appears). The Activities \<Show Disabled User(s)> entry adds them, marked (disabled), and the Activity Log always includes them so their history can still be read;
each person shown by display name, sorted by name. Two people with the same name show their login id after it, e.g. Al Smith (AL1);
you are not repeated in the list: the module's own My ... entry is you. (Lists you pick an assignee from, such as Assigned to, do include you.)

The list is read once per sign-in. Signing in to another database reads it again, and the To-Do list's Refresh button re-reads it, so a user added in the Administrator appears without restarting. If the user table cannot be read, the dropdowns keep only their own first entries (My ..., All users) rather than guessing.

The To-Do dialog's Assigned to always keeps the To-Do's current owner, even when that person is no longer in the list (a disabled login, for example), so opening and saving a To-Do never moves it to someone else by accident.

A user is a login, not an address-book entry, so TechieCRM never deletes one; the user right-click menu (Clients list or Related panel) has no Delete. It carries Disable Login instead, and Enable Login once the account is off. Disabling asks you to confirm, then switches the account off: the person can no longer sign in, the account is marked disabled everywhere TechieCRM shows it, every record they own stays exactly where it is, and the login can be switched back on at any time from the same menu. The Administrator's Manage Users page (A4) shows and changes the same state.

At the sign-in screen (new, September 2026). A disabled login is now stopped when it tries to sign in to the desktop app, not merely marked. The password box is checked first (the database still has to accept it), and then TechieCRM asks whether that user has been disabled. If it has, the sign-in is refused with "Login disabled", naming who can undo it, and nothing about the session changes: the login screen stays open for somebody else to sign in, and if the app was already open as another user it keeps the database it had. (Since October 2026 the new login is tried on a separate connection, so the open window never leaves its database while a different user's sign-in is being checked, refused or cancelled.) "Enabled (web off)" still signs in to the desktop; that setting only closes the web portal.

On a phone or tablet (October 2026). The iPhone/iPad and Android apps check whether their account is still switched on each time they check in with TechieCRM (when the app opens, at sign in, and when the app comes back to the screen after more than 15 minutes). A switched-off account is signed out with the message "This TechieCRM account has been switched off. Ask your administrator."; records on the phone are kept.

While the app is already open (new, October 2026). Disabling a login also reaches a desktop app that is signed in as that user right now. Every 15 minutes the app checks again whether its user is still enabled (in the background; you won't notice it). When the answer is a definite disabled:

Any record that is open with unsaved changes is saved on this computer, not to the database, so nothing typed is lost and nothing half-finished is written to the CRM.
Every open dialog is closed and the connection to the database is closed.
The app returns to the sign-in screen, which says "Your TechieCRM user has been disabled by an administrator." followed by how many records were kept on this computer, and the names of any windows whose unsaved work could not be kept.
The next time somebody signs in on that computer as that person (after the login is switched back on), a window called Unsaved work from your last session lists what was kept, with the before and after of each record. Keep reopens the record in its editor with the changes in place (it is only written when you save it, as usual); Discard throws the copy away.

So the person is signed out within about 15 minutes of you pressing Disable Login (a little longer if the computer was asleep in between). Pressing Enable Login again before then means nothing happens at all.

A check that cannot be answered never signs anyone out. If the CRM database cannot be reached, the user record cannot be read, or the answer is anything other than a definite disabled, the app carries on exactly as before and tries again 15 minutes later. MASTER is never signed out by this check.

This applies to Source CRM (SQL) sign-ins and to the Administrator window as well as the main window. A MongoDB (local) session, which signs in with a TechieCRM web portal account, is covered once the cloud reports whether that account is active (see Disabling a user on the web portal, below).

Recorded in the activity log (new, October 2026). Every Disable Login, Enable Login and Web Access change is written to TechieCRM's activity log first, as User Disabled, User Enabled or User Edited (for a web-only change), naming you as the person who did it and the user it was done to. If the entry cannot be written (the connection to the CRM database dropped), the change is not made and you are told why: changes to users are only made when they can be recorded. Try again once the connection is back.

Reading a user's activity. Everything a user did is listed under their record: the user dialog's Activity tab (right-click the user ▸ Open), Manage Users ▸ Activity Log… in the Administrator, and Setup ▸ Administration ▸ Activity Log on the ribbon for the whole workspace. Each user sees their own entries from your name menu ▸ My Activity…. See chapter A11, The Activity Log.

Deleting a login (the ADMN_Users records, the access rights and group memberships, and the SQL login behind them) is done in the source CRM's Administrator, not here. TechieCRM never deletes a user: a user's history and activity stay attached to their record, so disable the login instead. MASTER is the built-in administrator and can never be disabled; the menu item is greyed out for it. Enabling or disabling a login needs user-management rights on your own login.

Disabling a user on the web portal

The web portal never deletes a user either. Where there used to be a Delete button there is now Disable (and Enable once the user is off):

TechieCRM Admin ▸ All Users (TechieCRM's own administrators): each row has a Disable button (a person with a minus sign) or, for a disabled user, Enable (a person with a tick). Disable asks you to confirm. The user's own page has the same choice under Account Status, with a link to that user's entries in the Audit Log.
Workspace Admin ▸ Users (your workspace's administrators): open the user and untick User is active (untick to disable), then Save Changes. Tick it again to enable them.

What disabling does:

They can no longer sign in, on the web or with their portal account in the desktop app, and any web session they have open ends straight away.
Nothing is deleted. Their messages, team and group memberships, the records they own and every log entry they made stay exactly where they are. They are listed with a grey Disabled badge (the All Users filter calls it Disabled), not hidden.
Messenger keeps your conversation with them in the list, marked Disabled. You can still read it; you can't send them anything new.
Seats. Your plan counts active users, so disabling someone frees their seat at once. Enabling someone needs a free seat; if every seat is taken you are told so, and can disable another user or upgrade the plan first.
Each Disable and Enable is in the Audit Log as User Disabled or User Enabled, with who did it and when. If that entry can't be written, the change isn't made.

You can't disable your own account (it would sign you out of the page you are using). Only a root administrator can disable or enable another root administrator, and the last active root administrator can't be disabled at all.

Disabling a web user stops their next sign-in to the desktop app. A desktop app that is already open with that portal account (a MongoDB (local) session) is not yet closed: the app is ready to check every 15 minutes, but the cloud does not yet tell it whether the account is still active, so until it does the app keeps running until it is closed. Disabling does not take their computer off your licence either; removing a computer from the licence is a separate step (see Cloud Connection, chapter 13, "What a revocation does"). Asking TechieCRM to erase a person's data altogether (a privacy request) is handled by TechieCRM directly; see the privacy page.

User-management rights: what they now gate

Everything that changes another login is checked against the user-management right of the login you signed in with (the source CRM's Users right, the same one that puts the small key mark on a person icon in the Clients list). MASTER always passes. Without it you are told "Not permitted for your user ID" and nothing is written:

Action	Where	Right needed
Disable Login / Enable Login	Clients list right-click menu, and Administrator ▸ Manage Users	insert or modify
Change Password… for another user (your own needs no right)	Clients / Related user row right-click menu, and Administrator ▸ Manage Users	insert or modify
Editing a user's General tab (name, company, address, e-mail, phones) and pressing OK	Administrator ▸ Manage Users ▸ open a user	insert or modify
Add Member… to a security group	Administrator ▸ Security Groups & Teams	insert or modify
Remove Member from a security group	Administrator ▸ Security Groups & Teams	delete

One thing this does not do: it does not hide the menu items or the Administrator pages; you can still open them and read everything; the refusal happens when you try to save (for Change Password… on another user, when you press it: the password window does not open).

These rights and the sign-in check are separate questions and are answered in separate places. The rights above decide what a signed-in user may change about other users; Disable Login decides whether a user may sign in at all, and is enforced at the login screen (see Disabling a user login above). Deleting the SQL Server login itself is still the belt-and-braces way to lock somebody out of the database as well as out of TechieCRM, and is done in the source CRM.

(October 2026: Administrator ▸ Manage Users ▸ Change Password… used to open for any user without a rights check; it now follows the same rule as the right-click menu.)

(New in this release: before it, these four actions were not checked at all; any signed-in user could disable another administrator's login. If you rely on that, re-check who holds the user-management right in Manage Users ▸ Access Rights.)

When the database can't be read

A refusal to save is not the same thing as a database that could not answer, and from the September 2026 update the two no longer look alike:

Editing a user and pressing OK. If TechieCRM cannot read the shape of the user table (the connection dropped, or your sign-in isn't allowed to read the database catalogue), you now get "The user could not be saved" with the reason, and the dialog stays open so your typing is not lost. Before, the save quietly wrote nothing and reported "Nothing could be written: no editable field matched a column", which sounds like you filled the form in wrongly.
Security Groups & Teams. A database with no security groups shows "No security groups in this database." A database that could not be asked shows "Groups could not be read: …" with the reason, instead of the same reassuring "none".
The sign-in check. If TechieCRM cannot find out whether your login is enabled (the user has no record in the source CRM's user table, the connection dropped between proving your password and asking the question, or the setting holds a value TechieCRM does not recognise), you are let in, and told once: "Login state could not be checked", with the reason. That direction is deliberate. "We could not find out" is not the same answer as "you are disabled", and treating it as one would lock an entire company out of a database over a momentary fault. If you were relying on Disable Login to keep somebody out and you see that message, disable their SQL Server login too and have the user record checked in the source CRM.

Signing in without a SQL database at all (a MongoDB-only session) stays quiet in all three places: that is not connected, not broken. MongoDB (local) sessions are not covered by the Disable Login check at all: they sign in with your registered client.techiecrm.com account (see Choosing the database type at login), and the source CRM's user table is not read in that mode. Disable Login governs Source CRM (SQL) sign-ins.

"Administrator" means different things depending on whose workspace is being talked about. There are four kinds of login on the platform, and it is worth knowing which one you are dealing with, especially the last two, which belong to TechieCRM rather than to your company.

Login	Who has it	What it can reach
Workspace administrator	Your own company's administrator: the Admin role inside your workspace	Everything in your workspace: its users, security groups, teams, preferences, user-defined fields, email identity and plan. Nothing in anybody else's workspace, ever. This is almost certainly what you are.
TechieCRM staff	Somebody who works for TechieCRM	TechieCRM's own workspace, exactly the way you administer yours. Being a TechieCRM employee grants nothing about your workspace on its own.
Support administrator	A TechieCRM person who may be assigned specific customer workspaces, one at a time, by TechieCRM's own root administrator	Nothing by itself. It only makes it possible to be assigned a workspace.
Root administrator	TechieCRM's top account	Every workspace. This cannot be taken away; it is the account that has to be able to fix the platform when something has gone wrong with it.

Two things about that table are deliberate and are worth stating plainly rather than leaving you to infer them.

Being a TechieCRM employee is now a separate fact from being able to reach your data. It used to be one and the same: any TechieCRM login with the Admin role could open any workspace. Those are now two different things that have to be granted separately, which is what makes it possible to employ a TechieCRM administrator who administers only TechieCRM's own workspace.

Today, a TechieCRM administrator can still open your workspace without asking you first. That is being replaced: the plan is that a support administrator must request access and somebody in your workspace must approve it, per session, with a stated reason and a log you can read. While a TechieCRM person is inside your workspace you already see a "support view" badge at the top of the page, so it is never invisible. The request-and-approve step, the log and the ability to end a session yourself are described in their own chapter when they land; this note is here so that nobody discovers the current position from the badge rather than from the manual.

Access rights enforced today

User management: enabling/disabling logins, editing another user's details and changing security group membership all need the user-management right; see the table above.
Note rights: users without the source CRM's note-modify right see notes read-only (MASTER always can).
Full / Read access on notes, column setups, dashboards, KB owner: Public, Private, or a specific user/group, read live from the database.
Shared dashboards can't be edited in place (save-as-copy).
Cloud features are gated by the plan (A2).
HR & Payroll opens only for MASTER and the HR users you list (below). It is the one module the desktop closes to some users, not just makes read-only.
Personal (the Journal) follows TechieCRM's own Personal right (October 2026), not the source CRM, which has no right for it. Every person has read, change and delete on their own Journal by default (nobody ever sees anyone else's entries). An administrator can limit one person to No delete, Read only or No access: No delete hides and refuses Delete; Read only also hides and refuses New and Edit; No access refuses all three. MASTER always keeps full rights. A change reaches a running computer at its next sign-in or sync. There is no screen to set it yet: it comes with the Teams and rights pages of the Administrator window, so until then everyone keeps full Personal rights. The plan and the licence still apply on top (Chapter 19).

HR & Payroll access: choosing the HR users (October 2026)

HR & Payroll holds employee records, pay, leave and interview notes, so only MASTER and the logins on the office's HR users list can open it (Chapter 22 describes what a refused user sees). The source CRM has no right for this module, so TechieCRM keeps its own list.


Where	Settings ▸ HR & Payroll ▸ HR & Payroll access
Who can change it	MASTER, or a login with the user-management right (the same right as the table above). An HR user who is not an administrator sees the list greyed, with the reason. Anyone who is neither does not see the HR & Payroll tab at all.
How	Tick the people who run HR, press Save HR users. MASTER is not in the list: it is always allowed. A login that has since been removed from the database stays in the list, marked not found in this database, until you untick it.
Where it is kept	Once for the whole office, in the office database (TechieCRM's own settings table, the same one as the office-wide sign-in and Service settings), so every computer follows it. A copy goes to the TechieCRM cloud for the web portal (below).
When it takes effect	At once on the computer where you saved. On other computers a refused click takes effect within a minute, and the icon bar updates at the next sign-in or cloud check-in.
Before it is saved	Only MASTER can open HR & Payroll. The first administrator to sign in after the update sees a note, "HR & Payroll is now limited to the HR users you choose", with Choose HR users and Got it; either one stops it showing for the whole office.
If it cannot be read	Only MASTER can open HR & Payroll, and others are told why. Unlike the sign-in check above, this one closes rather than opens when TechieCRM cannot tell: HR records are not something to show by mistake.
A desktop signed in with MongoDB only	It has no office database, so it follows the copy of the list in your TechieCRM cloud (below). A person counts as listed by their CRM user ID linked to their TechieCRM ID, or by their TechieCRM ID's e-mail. The copy is read in the background at sign-in, at each cloud check-in and after each cloud sync. No cloud connection, a copy that cannot be read, is damaged or has not been read for more than 35 minutes, or a list never saved: only MASTER. The Settings list is shown greyed with where to change it (the web, or a desktop signed in to the office database); this computer never writes the list or the copy, and it shows no one-time notice.

The same list on the web portal and the local portal

Since HR-WEB (October 2026) the web portal and the local portal follow this list too.


Who gets in on the web	The workspace administrator (a login with the Admin role in its own workspace) always; anyone whose TechieCRM ID is linked to MASTER; and the HR users. A web user is matched by their sign-in e-mail or by any CRM user ID linked to their TechieCRM ID. Staff, Accounting and Client logins not on the list do not see HR & Payroll and are refused at its address. A TechieCRM support login that has opened your workspace is not its administrator and is refused too.
Never saved, or cannot be read	The administrator and MASTER only (the web has no MASTER login of its own, so its administrator stands in).
Where the web keeps it	A copy in your workspace's settings in the TechieCRM cloud. Every desktop copies the office database's list there when you save it and after each cloud sync.
Changing it on the web	Workspace Admin ▸ Preferences ▸ HR & Payroll ▸ Choose who can open HR & Payroll (administrators only): tick the people, press Save HR users. People are listed by CRM user ID (from your CRM user directory) and by TechieCRM ID. A listed name nobody has any more stays, marked Not found in this workspace, until you untick it.
How a web change reaches the desktops	The next desktop to finish a cloud sync writes it into the office database (its Updated by shows `web:` and the administrator's e-mail). If the list was changed on a desktop and on the web between two syncs, the later change wins.
The local portal	With a Config database it reads and writes the office database's list directly, so a change there is a change for every desktop at once (A13). Without one it keeps its own list.
Pay on other devices	The employee directory still syncs to every device. Pay and private HR details are sent only to a device whose signed-in TechieCRM ID is allowed into HR & Payroll by the rules above (Chapter 22).

It is a stopgap until teams and rights arrive, when an "HR" team takes over and starts with exactly the people on this list.

Security Groups on the web portal: what unticking Read does

On the web portal (Workspace Admin ▸ Security Groups ▸ Access Rights) the Read column is enforced. Unticking Read for a module and pressing Save Rights:

Closes the module for every member of that group, immediately: on their very next click, with no sign-out needed. Every way in closes together: the module's own page, its record windows, the panels it fills inside another module's page, and the app's data interface. There is no address that gets around it.
Members see a page saying they don't have access to that module, naming it, and telling them to ask their workspace administrator. It is not an error, and nothing else in their workspace changes.
The module also disappears from their sidebar, so nobody is invited to click something that will refuse them.

Three rules worth knowing before you tick anything:

Deny wins across groups. If someone is in two groups and one of them has Read unticked for a module, they are denied; the other group allowing it does not override the deny.
A group whose rights have never been saved allows everything. That is why an untouched group opens with every Read box already ticked: the screen is showing you what is true, not proposing a change.
Only Read is enforced today. Insert, Modify, Delete, Export and Print are recorded against the group but do not yet restrict anything. The page says so above the table.
A deny follows the records, not just the page. Pages that summarise other modules honour the same deny. In Reports, a report built from a module the member cannot read is simply not listed on the Reports page, and its address answers the same "you don't have access" message, so denying Service also removes Open Service Cases, denying Sales removes Sales Pipeline and Sales Won/Lost, and so on. Activity by User draws on Notes, To-Do List and Calendar together: denying one of the three removes that column and keeps the report; denying all three removes the report. My Work Day behaves the same way: a section whose module is denied is switched off rather than shown empty. Reports the member can read are unaffected.

Administrators are never locked out, by design: a workspace administrator can always open Security Groups and tick the box back on, and access returns immediately. That is also how you undo a mistake; nothing about it is permanent.

(This is the web portal's own security groups. The desktop's access-rights matrix is read from the source CRM and is still shown read-only; see "Not yet available" below.)

Modules in beta review, and the beta tester role

Some modules are finished enough to use and are still being reviewed before TechieCRM releases them. Those modules are open only to people who hold the beta tester role.

Open to everybody today: Clients (including the Related and Interactions panels on a client's page), Sales, Service, Dashboard, Library, Knowledge Base, Email, Calendar, Marketing, Agenda (My Work Day), Personal, Messages, Projects and Reports. Nothing about those changes.

(Calendar, Marketing, Agenda, Personal, Messages and Projects were released on 1 September 2026, and Reports on 3 September 2026. If you were using them as a beta tester, nothing about them changes for you either; the "In Beta Testing" ribbon simply stops appearing.)

In beta review: Inventory, Work Orders, Partners, To-Do List, Quotas, Financials, Agreements, Compliance & SLA, HR & Payroll, Notes and Documents. (Order Desk was on this list until it was retired into Financials, Chapter 24.)

The two add-ons are also in beta review: TechieCRM Connect (remote support) and the AI add-on (the cloud side of the AI features). See "The add-ons" below; they behave slightly differently because they are not ordinary pages.

On the desktop icon bar (25 October 2026) the modules in beta review, TechieCRM Connect included, are hidden by default for anyone who is not a beta tester; beta testers see them, and everyone can turn any of them on or off in Setup ▸ Settings ▸ Theme Layout ▸ Icon Bar Icons (Appendix A5). Showing one there does not change what follows.

Opening one of those without the role, in the desktop app or the web portal (October 2026), opens the module view-only: its icon (on the desktop icon bar, or in the web portal's left-hand menu) is dimmed with a green "B", and the module shows under a dimmed cover that says "Beta module: view only. Contact TechieCRM to join the beta programme." You can look and scroll, but not click, type, use its right-click menus or its ribbon's Home, Edit, View and Search commands (see Getting Started ▸ the icon bar). Nothing you try to change in the module is saved: if a change does reach the web portal (for example from a page opened with scripts switched off), it answers " is a beta module: view only. Nothing was saved." Beta testers see the green "B" and nothing else. On the phone apps the icon shows the same green "B" (dimmed if you are not a tester), and tapping it shows the beta message instead of opening the module. Either way it is not an error, and it is not a permission your own administrator withheld. Your workspace administrator cannot grant this one. Whether a module has finished review is a fact about TechieCRM's release programme rather than about your company, so only TechieCRM's root administrator can add somebody to the beta programme; ask TechieCRM support if you would like to help review a module.

Two things follow, and both are worth knowing:

It is off for everybody by default. Nobody acquires it by being senior, by being an administrator, or by working for TechieCRM.
A beta tester sees a diagonal "In Beta Testing" ribbon in the corner of every beta module's page, so it is never ambiguous which parts of the product are still under review. The same ribbon marks those modules on the public website. It disappears by itself when the module is released; there is nothing to switch off afterwards.

This is a different refusal from a security-group deny above. If the page says your administrator switched a module off, talk to your own administrator; if it says the module is in beta testing, talk to TechieCRM.

Where the refusal appears (September 2026 update). Until this update, a module your plan does not include was blocked only on the icon bar, by greying its button. Opening the same module from the ribbon (or from any command that simply needed that module's panel) went straight past it. A greyed button stops the obvious click and nothing else, so the two routes did not agree.

Both routes now ask the same question, so a module your plan does not include refuses wherever you open it from, with the message "Not included in your plan. Upgrade in the web portal". A module in beta review is no longer refused on the desktop: from either route it opens view-only for a user who is not a beta tester, and while it is on screen the ribbon commands that act on it are greyed, including commands on another module's ribbon that would act on it. Nothing has changed about what your plan includes; only about whether a second way in quietly bypassed it.

Desktop and mobile read the same role. When you sign in to the desktop app or a phone, the cloud tells that app whether you are a beta tester, so one change by TechieCRM applies everywhere you work without reinstalling anything.

The add-ons: Connect and AI

Both add-ons are in beta review, and both are refused in two places, because both are used from two directions: from the web portal in your browser, and from the desktop app or your phone with your licence key.

TechieCRM Connect. Starting a support session (generating a support key, or checking whether the customer has arrived) needs the beta tester role, whether you do it from the portal or from the desktop's Connect panel. In the desktop you will see the request refused with a message naming the beta programme, which is not the same as the "Remote support is not enabled for this workspace" message (that one means the paid add-on has not been switched on, and is fixed by buying it; this one is not). Your client is never affected. A customer joining a session you started, typing your support key at connect.techiecrm.com, or clicking your link, is not asked about beta testing and never sees any of this. They are not a TechieCRM user and the gate does not apply to them.
The AI add-on. The cloud side is what is in review: the cloud meeting summariser, and the service that lets a phone in the field find and use the AI agent running on your own computer. AI that runs entirely on your own hardware is not affected; TechieCRM's rule that AI functions run on a local model at no extra charge is unchanged, and Meeting Notes still records, transcribes and summarises on your own machine. Because these are machine-to-machine connections rather than pages, a refused request comes back as a short message to the app instead of a web page; there is no page to show, and no "In Beta Testing" ribbon on something that is not a screen.

For both add-ons the beta programme is attached to your licence, not only to your web login: TechieCRM can put a whole licence into the programme (so everyone working under it is in), or your workspace can be a TechieCRM partner, or the particular computer you signed in on can be recognised as yours after a real sign-in. Ask TechieCRM support which of those you want.

The Administrator window

The menu and the System Preferences pages (Clients, Key Fields, System Options, Locations/Resources, Mandatory Fields, Service, Sales, Diagnostic, Marketing, Automated Services, Dashboards, System Fields) are laid out to mirror the source CRM's Administrator; the working pages are Manage Users (edit a user's details, enable/disable the login, change a password, the access-rights matrix), Security Groups and Teams (group membership), Multi-User Licensing and the imports (A8). Everything else on the System Preferences side is still a placeholder; use the source CRM's Administrator for those.

Not yet available

Creating users (the SQL Server login and the account/rights defaults are created by the source CRM's Administrator; TechieCRM then shows and edits the user), editing access rights (shown read-only), creating security groups, user preferences, Windows authentication, database verification/repair, holiday editor (HR & Payroll has its own holidays for payroll, Chapter 22), and Change Password… on the Clients-list user menu (use the one in your own name menu, top right).

(Blocking a disabled login at the sign-in screen used to be listed here. It is built as of September 2026; see Disabling a user login. It applies to Source CRM (SQL) sign-ins; a MongoDB (local) session is governed by your TechieCRM account instead.)

Closing a MongoDB (local) session whose portal account was disabled while the app is open. The desktop side is built (October 2026) and waits for the cloud to report whether the account is active; until then such a session runs until it is closed. A Source CRM (SQL) session is already signed out within 15 minutes (see Disabling a user login).

Saved logins: recovery requests and the office recovery key (October 2026)

The Credential Storage Manager (Tools ▸ Security ▸ Credential Manager, chapter 31) keeps each person's saved logins encrypted with their own keys. Administrators (the MASTER login, or a login allowed to change users) see three extra tabs in it:

Office recovery key. Set it up once with Set up the office recovery key. It is held through each holding administrator's own saved-login keys, so there is no passphrase to type or keep. Give it to another administrator with Give it to another administrator (they must have opened the Credential Storage Manager once). Each person's logins are protected by it the next time they open the manager. Without it, a person who forgets their password and has no other signed-in computer loses the logins only they had.
Recovery requests. After you reset someone's TechieCRM password and they sign in with the new one, their computer asks for their saved logins back by itself. The request shows the person, the computer and the time. Approve only when you know their password was just reset; nobody types or remembers a code. Refuse a request you did not expect; they can ask again. You cannot approve your own request. Approving needs your own saved logins open and the office recovery key in your hands.
Business logins. The title, type, owner, holders and last change of every Business login, so ownership can be moved when someone leaves (People and owner ▸ Make owner, to someone who already has the login). You never see a password, cannot share a login you do not hold, and Personal logins are never listed. An administrator who holds the office recovery key receives these titles on their own computer through the cloud; the passwords never do.

The recovery key restores a person's own access; it is not a way to browse anyone's logins. The honest limit: an administrator's computer holds the office recovery key, so software altered on purpose could misuse it. Every request, approval and refusal is recorded with who, when and which computer (kept with the saved logins; there is no screen that lists those records yet).

The SQL / Mongo switch at the top of the sign-in window (October 2026), or Save / Open on the Configuration window's Database page (reached from the sign-in window's gear button; choosing a database there moves the switch to match), picks the session's database: Source CRM (SQL) (the normal choice; everything you do is written to the source database and automatically synced to the local Mongo database and, when a cloud account is connected, to the cloud) or MongoDB (local) (preview). MongoDB mode warns you before continuing: records are then created and updated ONLY in the Mongo database and are not synced back to the source SQL database. Modules that still read the source CRM directly show no data in a MongoDB session.

MongoDB mode signs in with your registered TechieCRM account (client.techiecrm.com email + password), not a database password. The sign-in is verified against the TechieCRM cloud; once verified on a computer it also works offline on that computer. Your session then acts as the CRM user linked to your TechieCRM account; with no link, as the CRM user whose source CRM record carries that email; if neither matches, you are not signed in and are told how to link (October 2026; it used to fall back to the last SQL login). See Your two email addresses, and the link between your two user IDs, below. The gear button opens the Configuration window; on its Database page, with Mongo chosen under Connect to, clicking the Database list lists the local Mongo server's databases, with TechieCRM databases marked, so you can pick the one to use. "Local" is the server TechieCRM is set to use: its own database, or the server saved under Settings ▸ Local Database ▸ Connect to another MongoDB server (A5). MongoDB mode is not available at all when neither exists; see What this computer can open, above.

This computer is recorded as yours (October 2026). When the sign-in is checked online, TechieCRM also tells the cloud which computer you signed in on (its computer ID and name, its operating system and the TechieCRM version), the same details it already sends when it checks the licence. The cloud then knows this computer is used by your TechieCRM ID, which is what lets Sync to Cloud in Settings ▸ Email keep your accounts' settings for you (Chapter 12), and lets one place at a time (see Signing in from more than one place) know who is signed in here, including an administrator's Signed in now list and the password change offered after This wasn't me. Nothing about the sign-in itself changes: the same window, the same messages. On a computer that several people share, the cloud records the last person who signed in online; a sign-in that was checked only on this computer (no connection) records nothing. A sign-in to your office database (Source CRM (SQL) mode) does not record anything either; it is still known by its database login.

Your sign-in on this computer, and My Devices (October 2026). When the cloud has this switched on for your workspace, a sign-in that is checked online also leaves a sign-in record for you on this computer: a code the cloud issued to you, for this computer only, after your password was checked here. It is kept in the computer's protected storage (on Windows, storage only your Windows account can open; on a Mac, a file sealed to this computer) and is never shown. It is what will let your mail accounts follow you to your other computers, and it is yours, not the computer's: two people who share a computer each have their own. Open your name in the web portal and choose My Devices to see every computer, phone and tablet that has signed in with your ID and whether you are still signed in on each one. Sign out ends your sign-in on a computer you have walked away from (it keeps its data and its licence, and asks for your password again the next time you use it there; it also stays allowed for your synced mail accounts, so that sign-in needs no new approval). Signing out on the computer itself counts the same way (October 2026): when you choose Sign out (switch user)… from your name menu, or Sign in as a different user… from the application menu, and someone else then signs in with their own TechieCRM ID, your sign-in on this computer ends at once and My Devices shows it Signed out straight away; your mail accounts stay allowed here for your next sign-in. Cancel in that window keeps you signed in. A sign-in that is checked only on this computer (no connection), or an office-database (Source CRM (SQL)) sign-in, does not sign you out on the cloud; My Devices then keeps showing you signed in until your own next sign-in here. If the cloud cannot be reached at that moment, your sign-in is still removed from this computer, but My Devices keeps showing you signed in there (press Sign out next to it on the web if you want it to say otherwise). Remove is for a lost or retired device: it is signed out at once and told to erase its TechieCRM data the next time it connects. Changing your password after This wasn't me, a password reset, or an administrator disabling your login signs every device out as well; your own computers simply ask for your password again. A computer learns it was signed out the next time it checks the licence (within fifteen minutes while TechieCRM is open). A sign-in checked only on this computer (no connection) leaves no record, and nothing changes for an office-database (Source CRM (SQL)) sign-in.

Your mail accounts and your devices (October 2026; once mail account sync is switched on for your workspace). The same sign-in record is what lets your mail accounts follow you: a new computer you sign in on shows a six-digit code and waits until you press Allow on one of your other devices showing the same code, or until you type your TechieCRM password there. Your accounts are sealed with a key only your allowed devices hold; the cloud, your administrator and your colleagues cannot read a mail password. Removing a lost device (Settings ▸ Email ▸ Your devices ▸ Remove Device, or My Devices on the web, which also erases its data) signs it out at once, and the next of your devices to open changes the key; TechieCRM then lists the mail passwords to change at your provider, because the lost device may still know them. A root administrator of TechieCRM can reset your shared mail accounts (with a reason; only root administrators see that control), and a password reset through Forgot password? does the same: the cloud copy is erased, nothing is revealed, your own devices keep their accounts and ask you before sharing again. The whole flow: Communications, Your mail accounts on all your devices.

In this mode your TechieCRM ID is who you are for one place at a time, even when your TechieCRM ID is matched to a login in your office's CRM. (Until October 2026 that combination could be turned away at sign-in once one place at a time was switched on for the workspace; it now signs in as the person this computer recorded.) If nobody has yet signed in online on this computer, the cloud cannot tell who is here; sign in once while connected.

While the account is checked (October 2026), the login window shows "Signing in..." in place of the Forgot password? link and greys the fields and Login; it stays responsive, Cancel or Esc gives up without signing in, and a second press of Login does nothing. Checking with the cloud can take several seconds on a slow connection (up to about 12 seconds before TechieCRM falls back to the sign-in remembered on this computer). The messages are the same as before. See What you see while you sign in in Getting started.

Your two email addresses, and the link between your two user IDs

Most people using TechieCRM with a source CRM have two user IDs:

User ID	What it is	What it signs in to
Your source CRM user ID (for example `ANN`)	Your login in the source CRM database. It is what owns your clients, notes and appointments there.	The source CRM database (Source CRM (SQL) at the login dialog), with your source CRM password.
Your TechieCRM login email (for example `ann@yourcompany.com`)	Your TechieCRM account: the address you registered with client.techiecrm.com. This is your primary email address in TechieCRM.	The TechieCRM cloud, the web portal, the mobile apps and the MongoDB (local) database, with your TechieCRM password.

The link. When your TechieCRM account is linked to your source CRM user ID (a link somebody confirmed; TechieCRM never makes one on a guess), TechieCRM knows the two IDs are the same person. The link is recorded against the database it was made on, because the same user ID (MASTER, say) is a different person in every database.

Your second email address. The email on your source CRM user record (its Email field) may not be your TechieCRM login, for example an older address, or a shared one. Since October 2026 TechieCRM keeps it as your second email address, beside your TechieCRM login email, and keeps it up to date: change it in the source CRM and TechieCRM picks it up within one sync (about 15 minutes). Your TechieCRM login email is never replaced by it.

Which one signs you in. Nothing changes about signing in:

signing in to the source CRM database uses your source CRM user ID;
signing in to the TechieCRM cloud, web portal, apps or the MongoDB database uses your TechieCRM login email (the primary one).

Your second email address is never treated as a login because it is on your user record. Typed at a TechieCRM sign-in, it works only if it happens to be registered as a TechieCRM account in its own right.

What the second address and the link are used for. Recognising you, not signing you in:

Territory Management. A territory's account managers are source CRM user IDs. The desktop now sends each manager's link, TechieCRM login email and source CRM email to the TechieCRM cloud with the territory, so web forms that assign a new entry by territory can find the manager's TechieCRM user by any of the three. (Web forms use this once the web portal's update for it is released; until then they match the emails only.)
MongoDB (local) sessions act as the source CRM user linked to the TechieCRM account that signed in (see Choosing the database type at login).
Filing email. Both addresses count as your own when you file an email (they are never offered as a client to file on), and a colleague in To or Cc is recognised by either of theirs.
The desktop's notification bell shows notifications sent to either of your addresses.

Which address TechieCRM sends to. Anything TechieCRM sends to a person goes to their TechieCRM login email (the primary one) when their two IDs are linked, and to their source CRM email only when they are not. This covers:

Monitoring alerts: changes to records and saved searches you monitor, and monitoring rule alerts (to the owner, to the people monitoring the record, and to any extra recipients the rule names). The address is decided when the alert is sent, so if you were monitoring a record before your IDs were linked, the next alert goes to your TechieCRM login email; you do not need to monitor it again. If a rule or an older monitor list names your source CRM email as well, you still get one alert, at your TechieCRM login email.
The "Ticket assigned to you" email and its notification bell notice (see chapter 4, Assigning a ticket to someone).
The monitoring "Who is told" list shows a person as "(no e-mail)" only when they have neither address.

Your Your monitoring emails choices (Settings ▸ General) are saved for both of your addresses whenever you change them. If you set them before your IDs were linked, open Settings and save them once more so they also apply at your TechieCRM login email.

When the two IDs are not linked, TechieCRM knows only your source CRM email, exactly as before October 2026.

How a link is made and kept (October 2026)

Where the link lives. A link is kept in your office's own database (the source CRM database every desktop and the local portal in your office already open), so every computer in the office sees it at once, with no internet and no waiting for a sync. When your licence includes the TechieCRM cloud, the cloud also checks every new link, because it is the one place that sees all your offices and computers together. A MongoDB-only office keeps its links in its MongoDB database.

Who can make a link. Only two people, and never TechieCRM on its own:

you, after entering both passwords in the same sign-in (your TechieCRM password and your source CRM password), which proves both IDs are yours;
an administrator, who links a person's two IDs for them; the administrator's own user ID is recorded with the link.

A matching email address is never enough: TechieCRM does not link two IDs because their emails agree.

The two rules: one to one (since 24 October 2026):

one person, one source CRM user ID. If you are linked to ANN, a link to ANN2 is refused (This TechieCRM ID is already linked to the CRM user ID ANN ...), in this database or any other of your office's databases. A link is never moved silently: remove the link to ANN first, then link ANN2. Linked to ANN in two databases is fine (it is one login). Upper and lower case are the same (ann is ANN);
one source CRM user ID, one person. In one database, if ANN is already linked to a colleague, a second person cannot be linked to it. You see who holds it, for example "The CRM user ID ANN is already linked to another TechieCRM ID (bob@yourcompany.com) in this database. An administrator must remove that link before it can be linked again." An administrator removes that link first.

Links made before the rule are kept, never removed for you. An administrator sees them under the links table on the Configuration window's Linked CRM logins page (The CRM user ID ... is linked to more than one TechieCRM ID ... Keep one: remove the others.); TechieCRM support can list them for every database with a read-only check. Until one is removed, a sale closed on the web portal or a phone for that person is not written to the office CRM (Your TechieCRM ID is linked to more than one login ...).

When the cloud says no. If the TechieCRM cloud refuses a link (the user ID is held by someone in another office, the TechieCRM ID is not on your licence, or it belongs to a different TechieCRM account), nothing is saved and you see the cloud's reason.

When the computer is offline. The link is saved in your office database straight away and works on every computer in the office. The cloud is asked again automatically with each sync (about every 15 minutes) until it answers. If the cloud then reports that someone elsewhere already holds that user ID, the office link is stopped, because the cloud decides between offices. A MongoDB-only office has no office database to hold the link meanwhile, so there the link is not made until the computer is back online.

Removing a link. A link is never deleted: it is marked as stopped, so "who was this person linked to before?" can always be answered. A stopped link never comes back on its own; linking the person again makes a new link.

What a link never holds: your source CRM password. The link records the two IDs, the database, who made it, when, and on which computer. The password for your source CRM user ID is kept, if you choose to keep it, in your Credential Storage Manager as an Office database login, never in the link and never in the office database.

What you can see today. The link store underneath all of this is in place and the desktop uses a confirmed link when it works out who you are (see Who the app thinks you are, below). There are three places to make a link, and all of them write the same link in the same place, so a link made on one is used by every desktop and the local portal:

signing in with your TechieCRM ID with SQL chosen (see Signing in to SQL with your TechieCRM ID above): the Link your CRM user ID window asks once for your CRM user ID and password;
the desktop's Configuration window, page Linked CRM logins (the gear on the sign-in window, before anyone signs in; Administrator Guide A14), described just below;
the local portal: the same Link my TechieCRM ID form on its Licence page, and Link another person for administrators on Config database ▸ Linked CRM logins (Administrator Guide A13).

The Link and Unlink buttons under Administrator ▸ Users are still coming; until then an administrator uses the Configuration window or the local portal. A link made through the TechieCRM cloud still reaches every computer with the next sync.

Linking in the Configuration window: Link my TechieCRM ID, Link another person, Remove (October 2026)

The Linked CRM logins page of the Configuration window works on the SQL Server database chosen on its Database page, before anyone has signed in:

Link my TechieCRM ID: type your TechieCRM ID and its password, then your CRM user ID and its password, and press Link my TechieCRM ID. Both passwords are checked now (the TechieCRM ID by the TechieCRM cloud, or by this computer's record of your last sign-in when offline; the CRM user ID by SQL Server), so the link is yours (Who can make a link, above). Tick Save in my Credential Storage Manager to keep the CRM password there as an Office database login, as at sign-in. If the database has no workspace ID yet and your CRM user ID may create tables (MASTER, or a login with db_owner), TechieCRM asks Prepare the database now, then link? and does both; if your CRM user ID may not, it says who can and nothing is written.
Your link then shows which CRM user ID your TechieCRM ID is linked to, and whether its CRM password is saved, with Remove my link (both passwords again). Only an administrator signed in on the page sees the table of every link, as on the local portal.
Let TechieCRM IDs sign in to SQL Server with a linked CRM login: shown once someone has signed in on the page; an administrator turns it Off or On for the whole office (above, The office can turn this off). Linking works either way.
Link another person (administrators): first Sign in as an administrator for this page with a CRM user ID that is MASTER or holds the user-management right (the rule Administrator ▸ Users uses). It is a real SQL sign-in and lasts until the window closes; Sign out of this page ends it sooner. Then type the person's TechieCRM ID (their email address) and the CRM user ID to link it to. The TechieCRM cloud finds the person in your office's TechieCRM account (only your own account is searched), and the link is recorded under the administrator's CRM user ID. If the cloud does not find the person, cannot be reached, or the CRM user ID is already someone else's, the page says so in those words and nothing is written.
Remove in a row of the table: an administrator removes it after a confirmation; anyone else removes a link with that link's own TechieCRM ID and both passwords. Removing marks the link as stopped, never deletes it.

Which TechieCRM account this session is (October 2026). When the cloud checks your TechieCRM ID at sign-in it names your account; the desktop now keeps that (in memory only, for this session) so it can find your link straight away, before its first licence check. A sign-in with a CRM user ID alone proves no TechieCRM ID, so it clears it.

Who the app thinks you are (record ownership)

Everything you create in the source CRM is stamped with a user login, the name that appears as the owner or creator of a client, note, appointment or message, and the name other people see when they ask "who wrote this?". The same login is what the emails and text messages you send are filed under.

TechieCRM works that login out in this order, and it always uses the first answer it can prove:

#	Where the answer comes from	Trusted?
1	The login you signed in to the source CRM with this session	Yes, proven
2	A confirmed link between your TechieCRM account and a source-CRM user	Yes, you confirmed it
3	The last login used on this computer, remembered from a previous session	No, a best guess
4	Nothing is known	–

Step 2 reads the link kept in your office database (or, in a MongoDB session, the copy on this computer; there the link counts only when every link of your TechieCRM account names the same source-CRM user). See How a link is made and kept, above: a link is made at a TechieCRM ID sign-in, in the Configuration window's Linked CRM logins page, or on the local portal.

Linking does not change how the "signed in somewhere else" check names you in your office: a linked person is still known by their source CRM user ID (in a source CRM database) or their TechieCRM login email (in a MongoDB database), the same names the local portal uses, so one person is never counted twice.

If nothing is known, TechieCRM has always fallen back to the login name MASTER when it files an outbound email or text message. That has not changed (changing it would re-file existing messages under a different name), but it is no longer silent: a warning is written to the log every time it happens, naming the reason. If you find messages filed under MASTER that should be yours, that warning is the evidence, and the fix is to sign in to the source CRM with your own login rather than opening the app without a database.

Support can read those warnings in logs/app.log, or turn on Settings ▸ Diagnostics for more detail. No password is ever written to a log file; the database password you sign in with is deliberately excluded from every message the app records, including error messages.

In a MongoDB (local) session there is no source-CRM sign-in at all, so step 1 cannot apply: the session acts as the CRM user matched to your TechieCRM account email, and if there is no match it says so rather than pretending (see Choosing the database type at login, above).

← Cloud, database and module setup

The Administrator program →