Team and permissions
Every church in Salterium has a team — the set of people who access that space. Each one has a role, and the role defines what they can do.
Only administrators see this page. Editors, operators, and viewers cannot invite or alter other users.
The users page
Access via the admin menu → Users. You'll see the team list with the invite button in the corner:
The list shows, for each person:
- Name — as they chose to present themselves in the profile
- E-mail — address used for login
- Role — administrator / editor / operator / viewer
- Status — active (already accepted and uses) or pending (invite sent, hasn't responded yet)
The four roles
Each role has a different permission level. Cumulative top-down — administrator can do everything an editor can, editor can do everything an operator can, and so on.
Administrator
The operational owner of the church. Manages the whole team, sets the visual theme, and has complete access to the library. They're the ones who invite the rest of the team and who maintain the space.
Editor
Looks after the library. Creates songs, edits lyrics, organizes collections, builds translations, creates notices. Doesn't touch the team or theme.
Operator
Conducts the service. Opens the desk, operates the projection, adjusts the timeline during the service, switches between songs and Bible. Doesn't create new content or alter the existing library — only uses it.
Viewer
Reads. Sees the library, follows the service via the 2nd screen, but doesn't operate or alter anything. Useful for support team (band, choir) who need to see what's coming but don't operate.
Inviting a new person
Click the + Invite button on top. Fill in:
E-mail — where the invite goes. Must be a real address.
Name (optional) — pre-fills the person's registration. If blank, they define their own name when accepting.
Role — administrator, editor, operator, or viewer. Start with the least privileged that makes sense — you can promote later.
Click Send invite. Salterium fires off an e-mail with a unique registration link. The person clicks, sets the password (if they don't have an account yet), and enters directly into your church.
Invites expire in 24 hours. If the person doesn't respond in time, just resend — click the pending invite in the user list and choose "Resend".
Removing / changing roles
In the user list, click on any person to open their panel. There you can:
- Change the role — promote from operator to editor, or demote
- Revoke access — removes the person from the church (doesn't delete their account, just disconnects them from your church)
The currently logged-in person cannot demote or revoke themselves — to prevent accidental lockout.
Security policies
| Policy | What it does | |---|---| | Isolation between churches | Your church never sees another church's data on the same Salterium. Library, users, notices, everything separate. | | Encrypted passwords | No password is stored in plain text. Strong, modern cryptography. | | HTTPS required | All communication between browser and server is encrypted — no one on the network can read it. | | E-mail invitation | No manual password distribution — each person sets their own via a unique link valid for 24h. | | Lockout on attempts | Multiple failed logins temporarily block the account — protects against brute force. | | Session per device | Logout on one browser doesn't end the others. To end everything, use "Sign out" everywhere. |
About church ownership
One of the people with administrator role is the owner of the church — the one who registered first. The owner has extra protection: cannot be demoted or removed by other administrators. To transfer ownership, the current owner must do it manually (on the church page).
Each user owns at most one church. You can be administrator of several, but owner of only one — protects against silent hijacking.
Next steps
- Profile and security — your account, your password, your e-mail recovery
- The operator's desk — back to operating the service