Roles and access
Choose what each role can use in your workspace, and who can see a document.
Lower a role, never raise it
Owners open Settings → Roles & access. Each role has its own tab, with the sections grouped by area. For each section you choose a level, from Hidden (or Names only) through View and Edit to Full, which also allows delete. Not every level is offered for every section. A role can be lowered below its default but never raised above it, and the owner always has full access. Reset to default undoes your changes for a role.
Clients, projects and tasks keep their names
Other records point at these three sections, so they go no lower than Names only. The name still appears where it is referenced, as plain text with no link, and nothing else about the record is loaded.
Money follows the money levels
Money levels also hide the matching money inside projects and clients: budgets, revenue, invoice lists and the like. Delete is its own permission: by default only owners and admins delete, and members can view, create and edit.
Who can see a document
On any file or folder, open Who can see this and choose the roles that should not find or open it. A hidden file answers like one that does not exist, and a hidden folder hides everything inside it. The creator, admins and the owner can change it. Whoever created the file always sees it, and the owner always sees everything. You can only hide a file from roles below yours: the owner can choose among all four roles, everyone else among Member, Accountant and Viewer.
API keys and webhooks follow the role
Lowering a level also narrows the API keys and webhooks that people in that role created, at once.