Features · team and access
Analytics user roles: who may look, and who may change things
Analytics user roles that keep private data private. Owners, admins and viewers in each organisation, invites by email, two-step sign-in and an audit log of who changed what.
Analytics user roles decide what each person on a team can see and change in an analytics tool. Skald has three per organisation: owner, admin and viewer. Visitors' addresses, names and emails show only to owners and admins, and every person search is logged. Part of Skald features.
30-day free trial · no card · we set it up within one working day · free to self-host
- ana@northwind.example · Anaowner · two-step on
- sam@northwind.example · Samadmin · two-step on
- lee@agency.example · Leeviewer · two-step off
- kim@northwind.example · invite pendingexpires in 6 days
Sample team. One role per person in each organisation.
[01] three roles
Owner, admin and viewer: three roles per organisation
An install holds organisations, and each site belongs to one. A person has one role in each organisation, and an organisation always keeps at least one owner. Pick a role.
May
Sees every page of the organisation's sites and the team list. Changes their own name, password and two-step sign-in. Changes nothing else.
May not
Cannot look a person up, and sees the left-out lists without names, emails or visitor IDs.
[02] invites
Invite your team by email, with a role
Admins and owners invite from Settings › Team & access › Team. Only an owner can invite another owner.
Invite
Type the email, pick a role, Send invite. The link works once, for 7 days.
Join
The person picks a name and a password. Someone with an account already just selects Join and keeps their own password.
Pending
Open invites show who sent them and when they expire. Resend makes a new link; Cancel stops it at once.
Change or remove
Pick a new role and it saves at once. Remove ends that person's sessions for the organisation at once.
If mail is not set up on your server, the page gives you the link to send yourself. The person then chooses a new password at their first sign-in, so you never know the password they go on to use.
[03] sign-in
Two-step sign-in and rules for the whole organisation
Each person signs in with their own email and password. Two-step sign-in adds a 6-digit code from any authenticator app.
Two-step sign-in
Turn it on in Your account, add the key to your app, confirm a code, and keep the 10 recovery codes. Each works once.
Organisation rules
An owner can require two-step sign-in for everyone, and set how long a sign-in lasts, 1 to 90 days. The default is 14.
Sign-in comforts
Show password, Keep me signed in for 14 days on a computer you trust, and a reset link that works once, for 60 minutes.
Never locked out
After 5 failed tries for one email in 15 minutes, each new try waits 30 seconds. Nobody can lock you out by guessing.
Your account shows where you are signed in, each browser with when it signed in and when it was last seen, and signs out everywhere else in one step. Saving a new password signs out every other session.
[04] audit log
An audit log of who changed what, and when
Settings › Audit log lists settings, team changes, tokens, sign-ins and failed sign-ins, newest first. Pick one kind of change, or download it all as CSV.
No password, token, link or address is ever written to it. A person search is logged as the kind of value and a one-way code of it, never the value. Admins may read it; viewers cannot.
- 10:42 sam@northwind.example · settings · Data retentionchanged
- 10:15 sam@northwind.example · people.search · ip · 7c1e…a code, not the value
- 09:58 ana@northwind.example · team · invite kim@sent
- 09:30 ana@northwind.example · conversions.testlead marked test
- 08:02 unknown · sign-in failedfailed
Sample rows.
[05] settings
Settings in the dashboard, with where each value comes from
Retention, what is kept about people, mail, sites, internal addresses, integrations and security are set on pages, not in a file on the server. A page you may not change is read-only, with the reason beside each field.
Where it comes from
Each value says whether it is this site's, the organisation's, the whole server's, the config file's, or the default, and if the config locks it.
Install admin
Settings for every site on the server (AI crawler rules, saved funnels, the internal-address list, the mail server, log paths) need this flag.
Add or remove sites
An admin adds a site step by step; only an owner removes one. A removed site's data is kept until the server admin deletes it.
Help in the app
Plain-word guides from every page, About Skald, and What's new once per release.
[06] no accounts needed
Or one shared password, if you do not need accounts
On a self-hosted install that does not need accounts, one nginx password can guard the dashboard instead. The server's config file then holds every setting, and its users are listed under Settings › Team & access › Users, managed by the server admin.
What it does not do
- Roles are per organisation. Settings that apply to every site on the server need the install admin flag.
- There is no public share link. Whoever opens a dashboard link signs in first.
- With one shared password there are no settings pages, invites, two-step sign-in or audit log page.
- Lost your phone and your recovery codes? The person who runs the server turns two-step sign-in off for you.
- An API token or an AI assistant sees addresses only with the Reading visitor addresses scope.
keep reading
More on analytics user roles
questions
Analytics user roles FAQ
Straight answers, including what Skald does not do.
What roles does Skald have?
Three per organisation. A viewer sees every page of the organisation's sites and changes only their own account. An admin can also invite and remove members, make API tokens, read the audit log, change a site's settings and look a person up. An owner can also manage owners, set the sign-in rules and remove a site.
How do I invite a colleague?
Admins and owners open Settings › Team & access › Team, type the person's email, pick a role and select Send invite. The link works once, for 7 days. Pending invites can be resent or cancelled. If mail is not set up, the page gives you the link to send yourself.
Does Skald support two-step sign-in?
Yes. Any authenticator app works: you type a 6-digit code after your password, and you get 10 recovery codes to keep. An owner can require two-step sign-in for everyone in the organisation and set how long a sign-in lasts, from 1 to 90 days.
Can viewers see visitors' IP addresses or emails?
No. Viewers cannot look a person up, and they see the left-out lead lists without names, emails or visitor IDs. Addresses, names and emails show only to owners and admins, and each person search is written to the audit log as a one-way code, never the value.
What does the audit log record?
Who changed what, and when: settings, the team, tokens, sign-ins and failed sign-ins, person searches and leads marked test. Admins can read it and download it as CSV. No password, token, link or address is ever written to it.
Can I use Skald without accounts?
Yes. In single-password mode, one nginx password guards the dashboard and the server's config file holds the settings. There are no settings pages, invites or two-step sign-in then; the server admin manages the users.
$ tail -f access.log | skald
See what AI does with your site. Free for 30 days.
No card. We set up hosted Skald for you within one working day, or you self-host it free. Every line of your log, sorted and added up.