How role-based access works in Vendeal
Everyone on your team sees and does only what their role allows, and records shared between a vendor and a dealership stay between those two.
September 15, 2026 · 3 min read
Role-based access control is easy to claim and easy to get wrong, usually by enforcing it only in the interface: hide a button and hope nobody finds another way in. In Vendeal, a role’s permissions are enforced on the server, so what a role can’t do, it can’t do.
A role for every job
Every person on a team has a role, and each role has a defined level of access to each area of the product: organization settings, billing, team, catalog, orders, invoices, CRM and, for vendors, intake forms. For each area, a role can view, edit or approve. A vendor’s Accounting role, for example, gets full control of invoices and billing but can only view orders. A Field Rep gets the reverse.
Your organization’s records stay yours
Access is also scoped to the organization. You only ever see the records that belong to organizations you are a member of, no matter what role you hold. A teammate in another company can’t see yours, and you can’t see theirs.
Shared records stay between two parties
A purchase order or invoice has two organizations attached to it, a buyer and a seller. It is visible only to members of those two, never to a third organization, even one that knows the record exists.
That’s the practical version of how access works. For a short overview of how we protect your data, see the Security page.