As your portfolio grows, more people work on it: an administrator, a maintenance person, an accountant, and of course the owners. Not everyone needs to see everything. Well-set permissions aren't just about data protection; they keep things tidy too: everyone sees what they work with.
Roles
- Manager: sees everything and grants access.
- Administrator: tenants, leases, payments.
- Maintenance: tickets and the flats they belong to.
- Accountant: finances, read access to documents.
- Owner: only their own flats.
Roles follow from tasks, not from people. If someone does two jobs, say administration and organising maintenance, give them both roles, but don't automatically give them everything.
Who should see what?
A few practical boundaries:
- Maintenance needs the flat's address, the issue and the tenant's contact details, not the rent or the lease.
- The accountant needs payments and invoices, not the tenant's personal documents.
- An owner needs data and finances for their own flats, and definitely not anyone else's.
The principle of least privilege
Everyone should see as much as their job requires. It's also a data protection duty: you may only process tenants' data to the extent necessary.
In practice, that means you start by giving less and only expand when someone really needs it. The other way round is much harder: if everyone sees everything, nobody will speak up that they see too much.
When someone leaves: right away
When someone leaves, revoke their access that same day. That's why you should avoid shared passwords: everyone should work with their own login.
A short checklist for when someone leaves:
- Revoke their access to the system.
- Collect the keys, and change the locks if needed.
- Hand over their open cases to a colleague.
- Change the passwords of shared accounts, if there were any.
- Notify tenants and tradespeople if this person was their contact.
Who did what?
If something goes wrong, you need to know who changed it. That's why every step should be traceable.
An activity log isn't about distrust. If a rent amount was entered wrong or a document went missing, the log shows what happened and the mistake can be fixed fast. In a dispute, it's also your evidence towards the owner.
Owners in the system
Owners are a special case: they're not part of the team, they're your client. They need a clear view of their own flats, but usually not the details of day-to-day work. If they can see payments, costs and lease status with their own login, you get far fewer phone calls. What owners expect is covered in our article on owner reports.
External partners
Tradespeople, cleaners, lawyers: often it's enough to give them the information for a single job, with no access to the system. Send them what they need, and don't give them a login "just to make it easier".
FAQ
How many people should have manager rights?
As few as possible, usually one or two. Manager rights give access to everything, including handing out permissions.
What if someone temporarily needs more access?
Grant it, but make a note, and revoke it when the task is done.
Does a small team need a data protection policy?
If you handle personal data, yes, even in a simple form. It sets out who can access which data and how long you keep it.
Rentkey
In Rentkey, team members work with roles, and owners see their flats with their own login. What you need from this for a good report is covered in this article.
