Manage Members in the Kalima Console
Invite people by email, CSV or link, suspend and sign out members, run offboarding, and give console roles and custom roles.
The Members area lists everyone in your company with role, teams, status, sign-in method and two-factor status. Viewers and suspended accounts take no seat.
The member list
- Views: All, Active, Invited, Suspended and Viewers, each with a count.
- Search: by name, email or team.
- Columns: name, role, teams, status, sign-in (Password, Google or Apple), two-factor, and whether the person takes a seat.
- Buttons at the top: Guests, Seat requests, Join requests (when a verified domain suggests joining), Custom roles and Invite members.
The roles in the app are Owner, Admin, Member and Viewer. Admins manage members, teams, billing and settings. Members record and work with recordings and take a seat. Viewers can only read and take no seat.
Invite people
Choose Invite members and one of three ways.
Invite by email
Your company can have at most 50 open invitations at a time. When every seat is taken or held by an invitation, you can still invite viewers. Only owners and admins can invite admins.
Invite from a CSV file
Choose Invite from a CSV file, then Choose CSV file or paste the lines. Download template gives you a file with the right columns.
- Columns: email, first name, last name, role, team. The first line may hold the column names. Columns are separated by commas, semicolons or tabs.
- Role: admin, member or viewer. Empty means member.
- Team: the name of an existing team, or empty.
- Limit: at most 500 lines per file.
Choose Check first. You see for every line whether it works, and nothing is sent yet. Lines with an error are skipped, the others get the usual invitation email.
Invitation links
Invitation links are for owners and admins. With a link, people request an invitation themselves: they enter their email address, get the usual invitation email and create a new company account with it. An existing private Kalima account never joins through a link.
When you choose Create link, you set:
- For: the whole company or one team. With a team, everyone who joins is added to it.
- Role: member or viewer. Admins are always invited one by one by email.
- Maximum: 1 to 500 invitations. At most 10 of them can be open at the same time.
- Valid for: 1, 7, 30 or 90 days.
- Only these domains (optional): up to 20 domains. Only addresses at exactly these domains can request an invitation.
The link is shown only once. Copy it right away; if you lose it, revoke it and create a new one. Revoke link also revokes open invitations requested through it. People who already joined stay members.
Suspend, sign out, reactivate
Open the actions menu of a person, or their member page.
- Suspend: the person is signed out on every device and can no longer sign in. Their recordings stay with the company. The seat becomes free.
- Lift suspension: makes the account active again, if a seat is free.
- Sign out on every device (on the member page, Sign out): ends the sign-ins in the browser, desktop app, phone app and console right away. A recording in progress is stopped and saved first. The person can sign in again straight away.
- Revoke invitation and Send invitation again for open invitations. A new invitation makes the old link stop working.
You cannot suspend yourself, and only an owner can change an owner. People managed through SCIM are suspended at your identity provider, not in the console.
The member page
Choose Open details to see a person's page. It shows:
- Role and teams, with the option to change the role.
- Console roles and Custom roles (see below).
- Sign-in: sign-in method and two-factor status.
- Sessions and sign-in history: after you choose Show, you see the active sessions and devices, and the sign-in attempts of the last 90 days with time, method, result, device, country and full IP address, including failed attempts with the reason. Opening it is noted in the audit log.
Only an owner can see an owner's sign-in history, and only owners and admins can see the history of admins.
Offboarding: Leaving the company
When someone leaves, suspend their account first. Their member page then shows Leaving the company with two steps. Owners and admins run it.
Check access. The list shows what is still open: console sign-ins, phones that get the account's notifications, connected AI apps, API keys and shared links to recordings. Choose Revoke per item or Revoke all. Revoked API keys do not come back, even if you lift the suspension later.
End the membership. Choose Keep the account suspended: the account stays and takes no seat, and you can lift the suspension later. Or choose Delete the company account: the person's own templates and settings are deleted with it. This cannot be undone.
Deleting the company account is not possible while the person still has recordings, projects or workspaces in the company, or while a legal hold covers them. The account then stays suspended.
Recordings are never handed over to another person. They stay with the company, for everyone who could open them before.
Console roles
Console roles give extra rights in the console, on top of the person's role in the app. Owners and admins assign them on the member page under Console roles. Owners and admins already have every right a console role can give.
| Role | What it may do | Seat |
|---|---|---|
| Member admin | Invites people as member or viewer, suspends and reactivates members, puts them into teams, signs them out on every device, ends their app connections and decides seat requests. Owners, admins and people with a console role are exempt. | Takes a seat, so the person needs the member role |
| Billing | Sees plan, seats and invoices under Billing, keeps the billing details up to date, manages payment and decides seat requests. Sees no other area apart from the overview. | No seat while the person is a viewer |
| Auditor | Reads the member list, policies, usage, audit log and privacy area, and can export usage and the audit log. Cannot change anything. | No seat while the person is a viewer |
Everyone with a console role needs two-factor sign-in for the console. Suspended people get no new console role; existing roles apply again once the suspension is lifted.
Custom roles (Enterprise)
On Enterprise you can build your own console roles from single permissions. Choose Custom roles at the top of the member list, then Create role, give it a name and pick permissions. You give the role to a person on their member page.
The permissions you can choose from:
- Members: Read the member list, Manage members, Decide seat requests
- Teams: Read teams, Manage teams
- Policies: Read policies, Change policies
- Sign-in & security: Read sign-in & security (read only)
- Vocabulary & templates: Keep the vocabulary, Manage templates
- Usage: See usage (by team, never by person)
- Billing: Read billing, Manage billing
- Audit log & privacy: Read the audit log, Read privacy
A company can have up to 20 custom roles. A role with Manage members takes a seat. Only owners and admins create and give custom roles.
A custom role can never include: handing over or deleting the company, the company export, legal hold, deleting under Policies (retention and zero data retention), changes to sign-in and security (including SSO, allowed networks and audit streaming), granting Kalima support access, API keys, webhooks, external sharing and guests, giving roles, and the content of recordings.
If your company leaves Enterprise, custom roles stay saved but give no rights until the company uses Enterprise again. You can still delete them and take them away.