# Staff support access

By default dembrane staff cannot read your projects. They get into a workspace only when a
workspace admin allows it, and each visit ends by itself after 24 hours.

You find the controls in workspace settings, "General", below "Access". Only workspace
admins see them.

## Two ways to let staff in

| | The switch | A request you approve |
|---|---|---|
| How it starts | You turn on "Allow dembrane staff to access this workspace for support" | A staff member asks, and you choose "Approve for 24 hours" |
| Who can come in | Any dembrane support staff, without asking again, while the switch is on | Only the person who asked |
| What they can do | Read only: projects, conversations, reports and usage | What a workspace admin can do, with the exceptions below |
| How long | 24 hours for each visit | 24 hours |

### The switch

The switch reads "Allow dembrane staff to access this workspace for support", with the
text "When on, dembrane support staff can join this workspace to help you. Their access
ends automatically after 24 hours."

Staff who come in this way can only read.

### A request

While the switch is off, a staff member can ask for access. Workspace admins get a
notification and the email "dembrane staff requested access to {workspace_name}", with the
staff member's note if they wrote one.

The request shows under "Pending access requests" as "{name} from dembrane", with "Approve"
and "Decline". Approving asks you to confirm: "Give {name} from dembrane admin access to
this workspace for 24 hours? Access ends automatically."

Staff who come in this way can do what a workspace admin can, except:

- invite people or manage members
- change workspace settings
- delete projects, reports or conversations

Approving a request does not turn the switch on. A request nobody answers expires after 7
days. If you turn the switch on while a request is waiting, the request is cancelled,
because staff can then come in directly.

## What staff can never do

However they came in, staff cannot:

- turn the support switch on or off
- approve or decline a support request
- approve who joins the workspace
- remove members or change roles
- share projects
- delete the workspace

## How it ends

- Each visit ends by itself after 24 hours. Staff can leave earlier.
- Staff can extend a visit by joining again. That restarts the 24 hours and you are told.
- If you turn the switch off, every running visit ends at once.
- When the last visit ends, the switch turns itself off. Workspace admins get the
  notification and email "Support access to {workspace_name} turned off": "Turn it back on
  in workspace settings if you need more help."
- If the switch stays on and no staff member came in for 7 days, workspace admins get a
  reminder, "Support access to {workspace_name} is still on". It repeats every week.

## What you can see

- "Access history" in the same settings section lists every step, newest first, with the
  staff member's name and the time. For example "Support access turned on", "dembrane staff
  requested access", "Access request approved", "dembrane staff joined for support",
  "dembrane staff extended their session", "dembrane staff left" and "dembrane staff access
  ended automatically".
- Workspace admins get a notification and an email when staff ask for access and when staff
  come in. They get a notification when staff extend a visit or leave.
- Staff on a support visit are not listed under "Members" and take no seat.
- dembrane keeps its own record of what staff do with their staff permissions.

## Related

- [Roles & permissions](./roles-and-permissions.md): what a workspace admin can do.
- [Notifications](./notifications.md): the notices and emails you get.
- [Data ownership & compliance](./data-ownership-and-compliance.md): who can reach your data.
- [Getting help](../users/host/getting-help.md): other ways to reach dembrane.