Understanding roles and permissions

By the end of this article, you will know how to pick the right role for each collaborator, fine-tune their permissions when needed and change a role already assigned.

In SynkriaOps, every user has a role that precisely defines what they can see and do within the company file. This system is built on the principle of least privilege: each collaborator only accesses the features necessary for their work, and nothing more. Understanding roles before inviting your team will prevent surprises: such as giving someone access to security settings when they don’t need them.

List of the company file's users with their role, activation status and pending invitations. — The Team page: every user in the company file with their role and status.

Choose among the five roles

SynkriaOps offers five roles, in decreasing order of scope: ADMIN, CFO, ACCOUNTANT (comptable), AUDITOR (auditeur) and CLIENT.

ADMIN: Administrator, full access

The ADMIN has access to the entire application, without restriction. It is the only role able to:

Change users’ roles (inviting and deactivating are shared with the CFO)
Modify VAT settings, accounting journals and the chart of accounts
Create and close a fiscal year (shared with the CFO), and reopen a closed year (ADMIN only, with a reason ≥ 10 characters)
Configure the company file’s sign-in and security settings

Typical use cases: managing director or partner, administrative and financial officer.

CFO: Chief Financial Officer

The CFO is a top-level financial steering role, sitting between the ADMIN and the ACCOUNTANT. In addition to all day-to-day accounting operations, it can:

Create and close a fiscal year (like the ADMIN)
Deactivate a product or a counterparty
Resolve (override) an approval request in the validation engine

It can invite colleagues and deactivate an access, but cannot change a user’s role or reopen a closed year (reserved to the ADMIN).

Typical use cases: chief financial officer, management controller, chief accountant in charge of closings.

ACCOUNTANT (comptable): data entry and exports

The ACCOUNTANT can perform all day-to-day bookkeeping operations, without accessing sensitive settings.

They can:

Create, edit (before posting) and post accounting vouchers
Perform reconciliation (lettrage) of counterparty accounts
View and export the general ledger, the trial balance, and all financial statements
Export the FEC for tax controls
Manage customers and suppliers, quotes and customer invoices
Import Mobile Money statements and reconcile bank transactions

They cannot:

Modify VAT settings, journals or the chart of accounts
Invite or deactivate users
Create, close or reopen a fiscal year

Typical use cases: staff accountant, data-entry manager.

AUDITOR (auditeur): read-only

The AUDITOR sees everything but modifies nothing. They can browse all financial statements, the general ledger and the trial balance without any risk of touching data.

They can:

View the dashboard and all its KPIs
Browse the general ledger, trial balance and journals in read-only mode
View quotes, invoices and financial statements (financial statements are available in simplified mode; the detailed mode is closed to this role)
Download PDFs of already-generated documents

They cannot:

Create, edit or post any accounting voucher
Export the FEC or regulatory exports
Access settings

Typical use cases: statutory auditor during review, minority partner with oversight rights, investor.

CLIENT: Reader (client), the firm’s portal

The CLIENT role, shown as Reader (client), is reserved for the client portal of an accounting firm. Its holder submits documents (customer and supplier invoices) and only sees the areas the firm has opened to them. Their access is managed by the firm: in Team management, the line shows “Client portal user: their access is managed by the accounting firm.”

Typical use cases: owner of a company whose books are kept by a firm, who sends documents without keeping the books themselves.

Fine-tune permissions with access groups and custom capabilities

Beyond these five base roles, SynkriaOps lets you fine-tune permissions at invitation time:

Access groups (role templates): predefined profiles bundling a coherent set of capabilities.
Custom capabilities: when inviting a user, you can compose a tailored role by ticking exactly the allowed capabilities, within the limits of your plan.

This granularity lets you match permissions to your organization without being limited to the five standard profiles.

Compare permissions role by role

The CLIENT role does not appear in this table: its rights are those the firm grants on the portal.

Action	ADMIN	CFO	ACCOUNTANT	AUDITOR
Accounting
Create/edit accounting vouchers	✓	✓	✓	✗
Post accounting vouchers	✓	✓	✓	✗
Reverse a posted voucher	✓	✓	✓	✗
Perform reconciliation (lettrage)	✓	✓	✓	✗
View general ledger / trial balance	✓	✓	✓	✓
Browse the chart of accounts	✓	✓	✓	✓
Modify the chart of accounts	✓	✗	✗	✗
Sales
Create quotes and customer invoices	✓	✓	✓	✗
View quotes and invoices	✓	✓	✓	✓
Send payment reminders	✓	✓	✓	✗
Purchases & expenses
Record a supplier invoice	✓	✓	✓	✗
Enter an expense report	✓	✓	✓	✗
Banking & treasury
Import Mobile Money statements	✓	✓	✓	✗
Reconcile bank transactions	✓	✓	✓	✗
View cash flow forecast	✓	✓	✓	✓
Counterparties & products
Manage customers and suppliers	✓	✓	✓	✗
View counterparties	✓	✓	✓	✓
Exports & reports
Export the FEC	✓	✓	✓	✗
Export financial statements to Excel	✓	✓	✓	✗
View financial statements	✓	✓	✓	✓
Settings
Invite / deactivate users	✓	✓	✗	✗
Modify VAT rates	✓	✗	✗	✗
Configure accounting journals	✓	✗	✗	✗
Create a fiscal year	✓	✓	✗	✗
Close a fiscal year	✓	✓	✗	✗
Reopen a closed fiscal year	✓	✗	✗	✗
Configure company file security	✓	✗	✗	✗

Frequently asked questions about roles

Can my accountant close a fiscal year? No. Closing a fiscal year is reserved to the ADMIN and CFO roles. It records the result for the year and locks its entries. Only the ADMIN can then reopen a closed fiscal year. See Close a fiscal year.

Can my accountant change the VAT rate? No. VAT settings are reserved to the ADMIN. An incorrect VAT rate can affect every invoice generated after the change: the restriction is therefore intentional.

Can an AUDITOR download the FEC? No. The FEC export is reserved to the ADMIN, CFO and ACCOUNTANT roles, because it contains all accounting data in a structured format intended for the tax authority. An AUDITOR user can view the financial statements in read-only mode in the interface.

Can I create a custom role? Yes. In addition to the five standard roles, you can compose a tailored role at invitation time using access groups and custom capabilities (see above).

Link an external accountant (firm mode)

An accountant’s access is not one of the five roles: the accountant accesses your company file on behalf of their firm. You invite them from Settings → Team management, Invite an accountant button (the accountant’s email and, if you wish, the firm name). The invitation is valid for 7 days.

By default, the accountant has full management of every module. In the Experts with access tab, the Permissions button lets you set, module by module, what the firm can do, and Revoke removes their access at any time.

To learn more, see Accountant permissions in firm mode.

Changing an existing role

Assigned the wrong role to a collaborator? No worries: the change is instant:

Go to Settings → Team management, Active members tab.
Click the user’s role badge (“Click to edit”).
Select the new role.

The change takes effect immediately: the user does not need to sign out.