Everyone gets exactly enough app.
Four roles, one tap each. Admins run the shop, crew leaders get the gig picture, crew get a scan-first app that physically cannot edit your inventory — and that last part is enforced by the database, not by hiding a button. Invite people with a link, and from then on every scan, every check-out and every repair flag carries the name of the person who did it.
One login, passed around the shop.
Everyone signs in as the company, because setting up real accounts was never worth the afternoon. So every person on the payroll has the power to delete a case, rename a category, or wipe a gig — and none of them meant to. When 40 feet of cable doesn't come home, the record says the change was made by "the account." That's not an answer, and it's not something you can coach anybody on.
The other version is worse in a different way: you did set up accounts, and the app hides the dangerous buttons from crew. Then a crew member taps something the menu forgot to hide, the screen says saved, and fifteen seconds later the change quietly reverts — because the database never agreed with the menu in the first place.
With GigPal PRO: each person has their own login and their own role, the database enforces that role independently of the interface, and every custody event in the system is stamped with a real name the server assigned — not a name the phone just handed over.
From one shared password to a real crew roster.
Bring someone on with a link.
Pick Crew or Admin, hit GENERATE INVITE LINK, and you get a one-off /join URL to text or email. Their address is optional and only there for your own reference — the token is what does the work. They open the link, sign in if they already have a login or create one on the spot, and they're in your workspace with the role you chose. No seat to provision, no password for you to know or reset.
Set the access level, one tap per person.
The roster lists everyone with their name and email. Three buttons under each row — Admin, Crew Leader, Crew — and tapping one is the whole operation. Two rows are deliberately not editable: the owner's, because that's set when the company is created, and your own, because an admin who demotes themselves by accident has just locked the shop. Both refusals come from the server, so they hold even if something goes wrong in the app.
The screens change to match the role.
Crew don't get a greyed-out inventory screen — they don't get an inventory screen. Every destination declares the minimum role that can reach it, and the sidebar, the mobile bar and even global search all read that same one list, so there's no third place for the rule to drift. Anything not on the list defaults to admin-only, which means a screen added tomorrow is locked down before anyone remembers to lock it down.
The database enforces it too — separately.
Hiding a screen is a courtesy. The real gate sits in the database: row-level security says members of your company may read equipment, gigs, cases, locations and categories, and only owners and admins may write them. Crew still need to move gear, so the handful of things they genuinely do — scan progress, a case check-out, a repair flag — go through named server functions that are scoped to the caller's own company and touch nothing else. The repair-flag function, for instance, can write the service level and its note. It cannot write a name, a quantity, a value or a category, because a repair flag must never become a side door into editing an item.
Every action arrives with a name on it.
Scans write an activity record the moment they happen: what was scanned, which gig it belonged to, which station or device it came from, and who did it. The "who" is stamped by the server from the signed-in session, not sent up by the phone, so it can't be faked or blamed on someone else. Leads and admins read the feed, filter it to one person, and see per-person tallies. If a wireless rack goes missing Friday afternoon, the log names exactly who had it last — no asking around the crew.
The parts you only appreciate after something goes wrong.
Built into the database, not the app
Your company's rows are scoped by membership at the database level. Even a query that forgets to filter by company still comes back with nothing but your own data — the database can't hand over another company's records, no matter what the app asks for.
One login, more than one company
Run a second entity, a demo, or a shop you consult for, and switch between them without a second password. Every membership call names the company explicitly, so promoting someone in one workspace can never touch their role in another — a real hazard when two companies share an owner.
Check in at the tech table
Optional and off unless you turn it on. A station screen shows a rotating six-character code — no ambiguous 0/O or 1/I — and crew scan or type it to unlock the app for a twelve-hour shift. The code rotates every three minutes and expires after fifteen, so an old photo of the screen is worthless. Admins are never gated.
A network blip never demotes anybody
Background refreshes run constantly, and any one of them can fail. When a role or setting lookup comes back empty, the app keeps what it already had rather than treating "no answer" as "no permission" — so a bad moment of signal can't flip an admin's screen to the crew view mid-load-in. The check-in gate fails open for the same reason: a status hiccup must never lock a crew out of the app.
The audit stays honest after a late sync
In a concrete ballroom with no bars, custody writes queue on the device and survive an app restart. Nothing re-reads from the server while anything is still queued, so a stale snapshot can't overwrite an entire load-out. Activity records replay stamped with the time they actually happened, not the time they finally reached the server.
Rolling data back is a higher bar than editing it
Restore points can put back other people's work, so restoring one is owner-only and verified on the server before any data is downloaded — not decided by the app. Another admin can see that a restore point exists; only the owner can open it and act on it.
Your logo shows up on every device that joins
Company name, logo, accent colour, background and three separate font choices are saved to the company, so a device that joins picks up the look automatically. Two admins editing branding at once get told: it detects that the saved version changed while you were typing and asks before overwriting somebody else's work.
Even we can't quietly widen it
Platform-level support access is its own explicitly listed set of accounts, checked server-side inside every function that uses it. It doesn't loosen the rules that keep companies apart, and it can't remove or demote the last owner of a company.
- Four roles
- Owner (set when the company is created) · Admin · Crew Leader · Crew. An admin assigns the lower three from the roster; owner is not assignable there by anyone.
- Crew can
- Scan gear in and out, look up read-only item info, flag a repair or replacement, and work the tech table. They cannot add, edit or delete inventory, cases, gigs or settings.
- Crew Leader adds
- Gigs, cases, locations, the dashboard, service, setups, the company archive and the activity audit — plus editing a single show's own wiring copy, while the shared template library stays admin-only.
- Refuses
- Changing your own role, changing an owner's role, an invalid role value, a person who isn't in that company, and removing or demoting a company's last owner. Each refusal is server-side with a plain-English reason.
- Activity record
- Action (out / in / info / service / case / strike / location), item or case, gig, station or device label, timestamp, and who — stamped from the signed-in session, not sent by the client.
- Sync
- A live subscription plus a background refresh roughly every 15 seconds; the activity feed polls faster while you're watching it. Your own scans appear instantly, before the round trip.
Real accounts, real names, no shared password.
Stop sharing one password across the whole crew.
Set up your company, invite your crew with a link, and watch the first week of scans come back with names on them.
Get Started → All features →