Tenant settings walkthrough

Open Manage in the top navigation, then Settings in the Administrator section of the rail (Branding sits just below it). The Settings page is a stack of cards; each covers one concern. Changes save when you click Save settings at the bottom — the form is atomic so partial saves aren’t possible.

Each row in the Reminders card is a “send X days before the occurrence” cadence. Add multiple rows if you want a two-touch schedule (e.g. one at 7 days, one at 1 day). Setting zero rows disables the reminder pipeline entirely.

A per-member override is planned so individual actors can opt in to a personal cadence or out entirely. Until it lands, this card is the policy.

The Defaults card’s New members willing by default checkbox decides what a new member’s preferences look like on day one. Ticked (the recommended default) means the solver considers them for every role they’re eligible for; unticked means they see a blank preference sheet and have to opt into each role.

A separate Roster policy card carries Allow members with unspecified sex in sex-restricted roles. Off (the safer default) means a member whose sex isn’t recorded is ineligible for sex-restricted roles — they can fill their profile or ask an administrator to.

Two visibility ladders control what tiers of member see on the Members directory:

• Household detail — who can click through from the directory to a family’s page. The household name always shows in the table; this gates the link, not the column. Defaults to All members.
• Postal address column — whether the address column shows, and to whom. Defaults to Administrators only because addresses are the most sensitive field on the directory.

Both use the same four-tier ladder: All members, Coordinators + admins, Administrators only, Nobody (hides it entirely).

Admin impersonation lets administrators sign in as any member to investigate a bug or set something up on their behalf. Every impersonation event is audited. Some ecclesias prefer this off; the default is on for support convenience.

Member self-service lets members edit their own sex after their 7-day onboarding window. Off is the safer default because sex changes affect scheduler behaviour against sex-restricted roles.

How members sign in lives on its own Security page (Manage → Security in the side rail), separate from the scheduler settings above.

Sign in with Google is off by default — enable it if your ecclesia wants members to use a Google account rather than a password. The allowed-domains list restricts which Google accounts are accepted (empty means “any Google account that matches a member email”; a list restricts to accounts under those domains). A member still needs an existing tenant record with a matching email; the OAuth flow only replaces the password step, not the member-of-tenant check.

Passkeys (also off by default) let members sign in with Face ID, Touch ID, or a security key. A passkey counts as multi-factor on its own, so there’s no separate code step. It’s a per-tenant opt-in; the member-facing sign-in experience is rolling out.

Click Save settings. A toast confirms the save; the audit log records who changed which fields. Some changes (reminder cadence, directory visibility) take effect immediately; others (default willingness on new members) apply to future member invitations only.