Security and Access¶

Loupe Factory uses role-based access to control what each person can see and change. This keeps sensitive customer, supplier, staff, pricing, and admin settings available only to the right users.

Admins manage user roles from Admin Settings > Users & Access.

Access Terms Used on This Page¶

Some internal permission charts use the term CRUD. In everyday language, that means a user can:

• Create: add a new record
• Read: view a record
• Update: edit an existing record
• Delete: remove a record

This page avoids the abbreviation where possible and explains each permission in plain language.

Default Roles¶

Loupe Factory uses three default roles.

Role Access Summary¶

Inventory permissions still follow existing inventory and location access. A user can read Retail Price only on records they can already access. Reading Retail Price does not grant CSV export access: Export CSV and Export All CSV remain admin-only.

For the steps to view or change prices, see Inventory Pricing.

How to Choose the Right Role¶

Choose Admin for people who are trusted to manage company setup, user access, integrations, pricing, and sensitive business records.

Choose Manager for operational leads who need to create and follow sales orders, run production, and work inventory, but should not receive the customer directory, inventory cost sheet, sales-order exports, or administrative controls.

Choose Member for users who need limited daily access, such as helping with production updates or checking inventory availability.

Component Rate Profile Access¶

Component rate profiles can hold sensitive pricing, rate source, currency, effective date, and costing context. Loupe Factory gives Admins full control, while Managers get a view-only experience for review and operational context. Members do not access the Component Rate Center by default.

Use this policy when deciding who should maintain shared material, labor, freight, packaging, service, or overhead rates. Admins should manage the rate records. Managers can inspect the records to understand the rate behind a cost, but cannot change the rate, apply it to linked cost components, or link inventory items to a rate profile.

Loupe Copilot Access¶

Loupe Copilot follows the same role-based access rules as the rest of Loupe Factory. A Copilot answer can only include records and fields that the person asking the question is already allowed to view.

For example, if a Manager can open a sales order but customer identity is hidden, Copilot must keep that customer identity out of the answer. If a Member cannot access invoices, Copilot cannot reveal invoice details to that Member.

Copilot is read-only. It can look up, summarize, and explain permitted records, but it cannot change, delete, move, approve, or create records in your account. Your business information is not used to train AI models.

Storefront Description Access¶

A storefront description is shopper-facing copy stored on an inventory item. Writing one, generating one with AI, and editing one are limited to Admin and Manager users on every plan. Members do not see Storefront Description on the item's More Actions menu.

Loupe Factory removes prices, currency, rate details, cost components, internal notes, tag IDs, and HS or HSN codes before the item reaches the AI. A generated description therefore cannot expose inventory pricing that a Manager is not allowed to view on the item record itself.

Every save is recorded on the item's history with who made the change and when. An admin can send a description to the linked Shopify product with a Shopify product push. The product type's description is used first. If it is blank, the newest Finished inventory item on that Product with a description supplies the copy. Each lot's description can also sync both ways through the Shopify variant-description metafield, which Loupe Factory creates when needed. See How Descriptions Reach Shopify. A JewelCloud feed includes each listed jewelry style's own storefront description as its public product description, sent as plain text. Internal notes are not included. See JewelCloud jewelry listing details. Every other channel needs someone to copy the text across.

See Storefront Descriptions for the full workflow, the tone options, and what to check before saving.

Manager Sales Order Access¶

Managers can keep sales moving without receiving the customer directory or the inventory cost sheet.

Managers can find Sales Orders, open a sales-order details page, and create an order through the standard form, Create with AI, or Pick from inventory. Universal search gives them the Sales Order page and Create action. It does not return individual order records. Members remain outside this workflow.

The access stops where admin work begins. These stay admin-only:

• purchase-order details
• customer records
• sales-order exports
• order edits
• payments
• invoices
• cancellations
• return actions
• shipment changes
• internal-note changes
• line-price changes
• deletions

Managers keep the authorized BOM, purchase-supply, and production launch points needed to move a sales order forward. They cannot fully manage or edit sales orders.

Customer labels managers see¶

A manager sees the customer's nickname chosen by your team. If it is blank, Loupe Factory uses uppercase initials, then a neutral Customer reference when there is no usable name character. The picker stays usable without turning the sales workflow into a customer directory.

Manager customer labels, cards, and order responses do not add full names, company names, email addresses, phone numbers, addresses, tax IDs, websites, avatars, customer links, or customer tooltips. Admins keep their existing customer view.

Do not treat a nickname or initials as anonymous. People inside the company may still recognize them.

Inventory costs managers do not see¶

Managers can view an inventory item's Sell Price and Retail Price, with the currency and price basis used to read those amounts. They cannot change inventory prices, currency, or price basis. The inventory record's Cost Price, inventory-source purchase price, and estimated internal cost remain hidden.

Managers can enter the negotiated sales or purchase price when creating an order. That order price is separate from the prices stored on inventory.

When a manager starts a purchase-order row from inventory, its editable price begins blank instead of copying the stock record's internal price. Admins keep the existing inventory-price prefill.

Managers still see authorized sales-order BOM values, including the rates, costs, sell amounts, and totals that belong to the BOM itself. The protected data is the inventory record's internal price, not every commercial number needed to do the work.

Protected before the page arrives¶

Restricted customer and inventory-cost fields are removed before Loupe Factory builds the page, form, search result, or AI summary. This is not a hidden column. Crafted form values cannot overwrite or clear pricing previously set by an admin.

Loupe Factory checks the role that belongs to the workspace currently open. Another workspace's role cannot grant restricted access. If the current workspace match cannot be verified, sensitive access stays closed.

Sensitive Information Rules¶

Loupe Factory limits sensitive information by role:

• Managers can create and open sales orders. Customer details stay off their labels, and the administrative actions listed above stay admin-only.
• Managers can view staff records, but staff contact details are hidden.
• Managers can view supplier records, but supplier information is hidden.
• Members cannot access customer, supplier, shipment, invoice, user-access, or integration settings by default.
• Cost Price is visible only to admins. Sell Price is visible to admins and managers. Retail Price is visible to admins, managers, and members on inventory records they can access. Managers and members cannot view the inventory record's estimated internal cost.
• Only admins can change inventory prices, currency, or price basis. Existing inventory and location access still applies, and reading Retail Price does not grant CSV export access.
• Component rate profile write actions are restricted to Admins. Managers can review rate profiles, rate history, and linked cost component references, but cannot create, update, remove, activate, deactivate, apply, or link inventory to rate profiles.
• Only Admin and Manager roles can select a product image from images already attached to related inventory items. Members cannot change product images.
• Only Admin and Manager roles can write or generate a storefront description. The AI that drafts one never receives prices, cost components, internal notes, tag IDs, or HS codes, so restricted values cannot reach shopper-facing copy.
• Loupe Copilot keeps restricted records and confidential fields out of answers when the person's role should not see them. See Loupe Copilot.

Verified List Exports¶

The records behind these numbers become portable the moment they are downloaded. When an authorized user exports customers, suppliers, staff, sales orders, purchase orders, or production jobs, Loupe Factory opens a one-time code dialog inside the app. Enter the code sent to your email and the download continues from the same page, with your search and filters intact. No sign-out, and no trip through the login page.

The verification follows the exact export. It is short-lived, works once, and is tied to the person, workspace, export type, and exact records requested. It cannot be reused for another file.

Your roles still decide who can export. The one-time code confirms identity. It never expands permissions.

After verification, Loupe Factory rebuilds the file from authorized live records in your workspace. Customer, supplier, and staff exports follow the current search and filters. Sales and purchase orders use the current page. Production uses the jobs already loaded.

A security receipt goes to the verified user and, when configured, the workspace billing contact. It includes the export type, actual record count, workspace, user, and time. The download does not wait for email delivery. The CSV is never attached, and no exported row data appears in the message. Receipts are sent after the export. They are not a complete history of every file that left the workspace.

Keep the workspace billing email current so the receipt reaches the right address.

Inventory Export Protection¶

Inventory CSV exports are available only to admins. Managers and members do not see Export CSV or Export All CSV, even when they can view or manage the inventory records on screen. Their access to Retail Price does not change this rule.

Every inventory export requires a one-time six-digit code sent to the admin's email address. The code expires after ten minutes and approves one export only. After the download, Loupe Factory sends a security receipt to the exporting admin and the workspace's billing contact. The receipt records the export type, record count, exporting admin, and time without attaching the CSV or including inventory data.

See Exporting Inventory to CSV for the difference between current-view and full-workspace exports. The same one-time email code is used for the other list exports above.

Inventory Deletion Protection¶

Delete all inventory items, in Admin Settings > Inventory Settings > Reset, removes every inventory item in the workspace in one step. Only admins see the control. Managers can delete the individual inventory records their role allows, but neither managers nor members can clear the whole inventory.

The deletion is protected the same way as an export. The admin confirms with a one-time six-digit code sent to their email address. The code expires after ten minutes and approves that deletion only. Loupe Factory then sends a security receipt to the admin who deleted the items and the workspace's billing contact. The receipt records how many items were deleted, what was removed with them, who did it, and when. Anyone who receives a receipt for a deletion they did not authorize should contact their workspace administrator right away or reply to the email.

See Deleting All Inventory Items for what is deleted, what is kept, and the steps.

Location-Based Inventory Access¶

Inventory visibility also depends on the user's assigned location and the organization's location settings.

Admins can turn on Managers can use inventory from all locations in Organization Settings > Locations. When enabled, Manager users can view and select inventory items or products from every location in the organization. This is useful when one operations lead handles stock across multiple warehouses, factories, showrooms, or fulfillment sites.

When the setting is disabled, Manager users are limited to inventory from their assigned location.

Members can only see inventory items and products from their assigned location. This restriction still applies when manager cross-location access is enabled.

The setting is available on Professional, Business, and Enterprise. It is not available on Starter.

Managing User Access¶

To invite users or change their role:

1. Go to Admin Settings > Users & Access.
2. Open Invite New Users to invite a new person, or open Members to update an existing user.
3. Assign the correct role: Admin, Manager, or Member.
4. Save the change.

Role changes affect what the user can see and do the next time they work in Loupe Factory.

Related Pages¶

• Users & Access: Invite users and assign roles
• Staff Management: Create and manage staff records for operational assignment
• Component Rate Profiles: Manage reusable rates and review rate-profile access by role
• Loupe Copilot: Ask business questions with role-aware, read-only answers
• Storefront Descriptions: Write shopper-facing item copy, and review what the AI is never shown
• Inventory Settings: Reset inventory catalogs or delete every inventory item after email verification
• Order Management: Record payments and see what managers can create on a sales order
• Organization Settings: Manage locations, departments, designations, and compliance details