‹ ALL FEATURES
TEAM & SECURITY

Everyone gets exactly enough app.

Four roles, one tap each. Admins run the shop, crew leaders get the gig picture, crew get a scan-first app that physically cannot edit your inventory — and that last part is enforced by the database, not by hiding a button. Invite people with a link, and from then on every scan, every check-out and every repair flag carries the name of the person who did it.

◈ MEMBERS & INVITES4 PEOPLE
Roeroe@company.comOWNER
Lachlanlachlan@company.comCREW LEADER
Samsam@company.comCREW
Admin · Crew Leader · Crew — tap to set
Crew: scan + flag repairs + read-only info.
Crew Leader: + the activity audit. Admin: full access.
✕ Ask another admin to change your own role
The server refuses it, so nobody can lock themselves out of their own shop.
WITHOUT IT

One login, passed around the shop.

Everyone signs in as the company, because setting up real accounts was never worth the afternoon. So every person on the payroll has the power to delete a case, rename a category, or wipe a gig — and none of them meant to. When 40 feet of cable doesn't come home, the record says the change was made by "the account." That's not an answer, and it's not something you can coach anybody on.

The other version is worse in a different way: you did set up accounts, and the app hides the dangerous buttons from crew. Then a crew member taps something the menu forgot to hide, the screen says saved, and fifteen seconds later the change quietly reverts — because the database never agreed with the menu in the first place.

With GigPal PRO: each person has their own login and their own role, the database enforces that role independently of the interface, and every custody event in the system is stamped with a real name the server assigned — not a name the phone just handed over.

HOW IT WORKS

From one shared password to a real crew roster.

STEP 01

Bring someone on with a link.

Pick Crew or Admin, hit GENERATE INVITE LINK, and you get a one-off /join URL to text or email. Their address is optional and only there for your own reference — the token is what does the work. They open the link, sign in if they already have a login or create one on the spot, and they're in your workspace with the role you chose. No seat to provision, no password for you to know or reset.

INVITE A TEAM MEMBER
THEIR EMAIL optional — for your reference
ROLE CREW · can scan and view pack listsCREW
✓ Link ready — share it with your team member
app.gigpalpro.com/join?token=…
COPY
"You've been invited" → SIGN IN & JOIN, or CREATE ACCOUNT & JOIN
STEP 02

Set the access level, one tap per person.

The roster lists everyone with their name and email. Three buttons under each row — Admin, Crew Leader, Crew — and tapping one is the whole operation. Two rows are deliberately not editable: the owner's, because that's set when the company is created, and your own, because an admin who demotes themselves by accident has just locked the shop. Both refusals come from the server, so they hold even if something goes wrong in the app.

TEAM ROSTER
Roe (you)locked — ownerOWNER
Lachlan Admin · Crew Leader · CrewLEAD
Sam Admin · Crew Leader · CrewCREW
Admin — full access, manage everything
Crew Leader — scan, flag, read-only info + audit
Crew — scan, flag a repair, read-only info
STEP 03

The screens change to match the role.

Crew don't get a greyed-out inventory screen — they don't get an inventory screen. Every destination declares the minimum role that can reach it, and the sidebar, the mobile bar and even global search all read that same one list, so there's no third place for the rule to drift. Anything not on the list defaults to admin-only, which means a screen added tomorrow is locked down before anyone remembers to lock it down.

WHO SEES WHAT
HOME · SCAN · TECH TABLE crew and upCREW
GIGS · CASES · DASHBOARD · SERVICE crew leader and upLEAD
SETUPS · RECORDS · NETWORK · BUILD crew leader and upLEAD
INVENTORY · LABELS · SETTINGS admin onlyADMIN
Unlisted screen → admin only. Safe by default, not by memory.
STEP 04

The database enforces it too — separately.

Hiding a screen is a courtesy. The real gate sits in the database: row-level security says members of your company may read equipment, gigs, cases, locations and categories, and only owners and admins may write them. Crew still need to move gear, so the handful of things they genuinely do — scan progress, a case check-out, a repair flag — go through named server functions that are scoped to the caller's own company and touch nothing else. The repair-flag function, for instance, can write the service level and its note. It cannot write a name, a quantity, a value or a category, because a repair flag must never become a side door into editing an item.

◈ ROW-LEVEL SECURITY
members read equipment — your company only
managers write equipment — owner / admin only
members insert scans — everyone on the crew
NARROW CREW WRITES
set_service_flag — service + note. Nothing else.
set_packlist_flow — scan progress on one gig
set_case_checked_out — kit case in/out
✕ not a member of that org
STEP 05

Every action arrives with a name on it.

Scans write an activity record the moment they happen: what was scanned, which gig it belonged to, which station or device it came from, and who did it. The "who" is stamped by the server from the signed-in session, not sent up by the phone, so it can't be faked or blamed on someone else. Leads and admins read the feed, filter it to one person, and see per-person tallies. If a wireless rack goes missing Friday afternoon, the log names exactly who had it last — no asking around the crew.

ACTIVITYLIVE · ALL DEVICES
OUTShure BLX4R Wireless Sam · Ridgefield Gala · 2m ago
INCASE-04 Comms Lachlan · tech table · 14m ago
FLAGGEDProjector 2 — lamp hours Sam · repair · 41m ago
CASEFOH Flypack Roe · Mac Mini · 1h ago
Filter by person · per-person tallies · refreshes about every 5s
THE DEPTH

The parts you only appreciate after something goes wrong.

TENANT ISOLATION

Built into the database, not the app

Your company's rows are scoped by membership at the database level. Even a query that forgets to filter by company still comes back with nothing but your own data — the database can't hand over another company's records, no matter what the app asks for.

MULTI-WORKSPACE

One login, more than one company

Run a second entity, a demo, or a shop you consult for, and switch between them without a second password. Every membership call names the company explicitly, so promoting someone in one workspace can never touch their role in another — a real hazard when two companies share an owner.

PRESENCE GATE

Check in at the tech table

Optional and off unless you turn it on. A station screen shows a rotating six-character code — no ambiguous 0/O or 1/I — and crew scan or type it to unlock the app for a twelve-hour shift. The code rotates every three minutes and expires after fifteen, so an old photo of the screen is worthless. Admins are never gated.

FAILS THE RIGHT WAY

A network blip never demotes anybody

Background refreshes run constantly, and any one of them can fail. When a role or setting lookup comes back empty, the app keeps what it already had rather than treating "no answer" as "no permission" — so a bad moment of signal can't flip an admin's screen to the crew view mid-load-in. The check-in gate fails open for the same reason: a status hiccup must never lock a crew out of the app.

NO-SIGNAL VENUES

The audit stays honest after a late sync

In a concrete ballroom with no bars, custody writes queue on the device and survive an app restart. Nothing re-reads from the server while anything is still queued, so a stale snapshot can't overwrite an entire load-out. Activity records replay stamped with the time they actually happened, not the time they finally reached the server.

OWNER-ONLY RESTORE

Rolling data back is a higher bar than editing it

Restore points can put back other people's work, so restoring one is owner-only and verified on the server before any data is downloaded — not decided by the app. Another admin can see that a restore point exists; only the owner can open it and act on it.

YOUR BRAND

Your logo shows up on every device that joins

Company name, logo, accent colour, background and three separate font choices are saved to the company, so a device that joins picks up the look automatically. Two admins editing branding at once get told: it detects that the saved version changed while you were typing and asks before overwriting somebody else's work.

SUPPORT ACCESS

Even we can't quietly widen it

Platform-level support access is its own explicitly listed set of accounts, checked server-side inside every function that uses it. It doesn't loosen the rules that keep companies apart, and it can't remove or demote the last owner of a company.

Four roles
Owner (set when the company is created) · Admin · Crew Leader · Crew. An admin assigns the lower three from the roster; owner is not assignable there by anyone.
Crew can
Scan gear in and out, look up read-only item info, flag a repair or replacement, and work the tech table. They cannot add, edit or delete inventory, cases, gigs or settings.
Crew Leader adds
Gigs, cases, locations, the dashboard, service, setups, the company archive and the activity audit — plus editing a single show's own wiring copy, while the shared template library stays admin-only.
Refuses
Changing your own role, changing an owner's role, an invalid role value, a person who isn't in that company, and removing or demoting a company's last owner. Each refusal is server-side with a plain-English reason.
Activity record
Action (out / in / info / service / case / strike / location), item or case, gig, station or device label, timestamp, and who — stamped from the signed-in session, not sent by the client.
Sync
A live subscription plus a background refresh roughly every 15 seconds; the activity feed polls faster while you're watching it. Your own scans appear instantly, before the round trip.
WHAT YOU GET

Real accounts, real names, no shared password.

Invite by link — they sign in or sign up and land in your workspace
Admin / Crew Leader / Crew, changed in one tap per person
Crew see a scan-first app, not a locked-out version of yours
Inventory edits gated in the database, not just in the menu
Every scan and check-out tied to a name the server assigned
Optional check-in gate with a rotating tech-table code
One login across more than one company, cleanly separated
Your logo, colours and fonts on every crew device

Stop sharing one password across the whole crew.

Set up your company, invite your crew with a link, and watch the first week of scans come back with names on them.

Get Started → All features →