Account, team and security

Everything about you, your colleagues and your organisation's access lives in the account button at the top right of the app (it shows your initial and organisation name). The small dot is the live-update connection: green when connected, gold when reconnecting. The panel has five tabs: "You", "Team", "Organisation", "Plan" and "Group".

Signing in

There are three ways to sign in. Whichever you use, it's the same SupplierVault account as long as the email address is the same.

If you've turned on SupplierVault two-step sign-in, you're also asked for the 6-digit code from your authenticator app. See Sign in with Microsoft or Google for set-up details and what your IT team may need to approve.

Forgotten your password?

1. On the sign-in page, click Forgotten your password?
2. Enter the email you sign in with and click Send reset link. You'll see "If that email has an account, a reset link is on its way". We say this whether or not the email has an account, so nobody can use the page to find out who uses SupplierVault.
3. Open the email "Reset your password" and click Choose a new password. SupplierVault opens: click Continue.
4. Type your new password twice (at least 8 characters; use Show to check it) and click Save new password. You'll see "Password changed" and you're signed in.

• The link works once and lasts an hour. If it has expired or been used, you'll see "That link has expired or has already been used" with the form to request a new one.
• The extra Continue step is deliberate: company email scanners (such as Microsoft Defender) open links in emails to check them, which would otherwise use up one-time links before you click them.
• You can open the link on any device; it doesn't have to be the one you asked from.
• If you sign in with Microsoft or Google you don't need a SupplierVault password: your organisation looks after that one.

Didn't get the confirmation email when you signed up?

Check your junk folder. Then try to sign in: you'll see "Please confirm your email first" with a Send the confirmation email again link.

The "You" tab

Your name

"Shown to colleagues." Change it and click "Save".

How you sign in and changing your password

How you sign in shows your account email and the ways it has been used (email and password, Microsoft, Google). If you have a SupplierVault password, click Change password, type the new one twice and click Save password. If you only sign in with Microsoft or Google there's no SupplierVault password to change; you can add one with "Forgotten your password?" on the sign-in page.

Two-step sign-in

If you signed in with Microsoft or Google, your organisation's own two-step checks already apply, and you can add a SupplierVault code as well.

1. Click "Set up two-step sign-in".
2. Scan the QR code with an authenticator app such as Microsoft Authenticator or Google Authenticator. If you can't scan, enter the key shown instead.
3. Type the 6-digit code the app shows and click "Turn on".

If the code is refused, check the time on your phone is set automatically and try the newest code. To switch it off, click "Turn off" twice.

Calendar feed

A private link that puts your key dates into Outlook, Google or Apple Calendar and updates itself. Click "Create my calendar link", then "Copy link", "Open in Outlook or Apple Calendar" or "Add to Google Calendar". In Outlook on the web: Calendar › Add calendar › Subscribe from web, then paste the link.

The feed contains: notice deadlines ("Give notice" or "Cancel before auto-renewal", with reminders 30, 7 and 1 day before), last days to change volumes or prices, contract end dates, open contract obligations with due dates (yours and the supplier's), and your own open tasks. It only includes suppliers you're allowed to see. Calendar apps usually refresh it every few hours.

Anyone with the link can see these dates, so keep it private. Creating a new link stops the old one; "Turn off my link" stops it entirely.

Delete my account and sign out

"Delete my account" removes your sign-in. Type DELETE to confirm. Organisations where you're the only member are closed and their data deleted; records you created in shared organisations stay with them. You can't delete your account while you're the only admin of an organisation that has other members: make someone else an admin first. "Sign out" is at the bottom.

The "Team" tab: inviting colleagues

1. Under "Invite a colleague" (admins only), enter their email and choose a role: Editor (the default), View only, Admin, Auditor, or one of your own roles under "Your roles".
2. If access by area is on, choose "Areas they'll see".
3. Click "Invite". We email them an invitation straight away.
4. They click Accept invitation, then sign in with Microsoft or Google, or create a password, using that same email. They're added as soon as they sign in.

Pending invitations show under "Waiting to join" with when they were emailed, and buttons to Email again, Copy link (to send it yourself) or Cancel. If an email couldn't be sent you'll see "Email not sent" and the reason. See Invite your team. Admins can change anyone's role with the drop-down or remove them with "Remove". An organisation must always keep at least one admin.

Roles: exactly what each can do

Admins can also create custom roles: an Editor limited to the things the role allows, such as only payments or only purchase requests. See Custom roles.

The Auditor (read-only, time-limited) role has the same abilities as View only, for a set period of up to a year. Auditors and admins can also check the audit trail and download the access log under Organisation › Audit evidence. See Audit evidence for auditors.

Nobody, including admins, can edit or delete the audit trail. When a member who isn't View only first signs in, a stakeholder record is created for them (team "Unassigned") so their approvals and tasks are recorded against them. An admin should set their team on the Stakeholders page.

The "Organisation" tab

Who sees which suppliers (access by area)

Choose "Everyone sees every area" (default) or "Each person sees only the areas they're given (set them in Team)". Restricting access by area is included from the Professional plan.

When it's on, each person sees only suppliers in their areas, along with those suppliers' tasks, invoices, files, requests, history, portal links, signatures and calendar dates. Totals and charts cover their areas only, and they see a banner saying so. People and settings aren't area-restricted. Admins always see everything. Moving a supplier to another area moves everything linked to it. Set each person's areas in the Team tab with "Change". If their team covers set areas (Settings › Teams), the Team tab shows "Areas: … (from the … team)", and any areas you add there are on top of the team's. See Teams.

Company sign-in only

Tick "Everyone in … must sign in with Microsoft or Google (no SupplierVault passwords)". Use it if your organisation runs on Microsoft 365 or Google Workspace, so your IT team controls who can sign in and how.

• It needs a work account: a Microsoft Entra ID (Microsoft 365) account or a Google Workspace account. A personal Google account doesn't count, even if it uses a work email address.
• Work-account sign-ins are re-checked every 12 hours. If IT has switched someone's account off, they can't get back in, so leavers lose access within the day.
• You can only switch it on while you're signed in with your own work account, so you can't lock yourself out. Before you do, the tab lists anyone who hasn't signed in with a work account yet; they'll be asked to next time.
• Switching it on (or requiring two-step sign-in) stops everyone's existing calendar links. People create a new one from the You tab.
• Once it's on, anyone who signs in with a password sees "Sign in with your work account" and can't open the organisation until they do. The database enforces this on every request, not just the screen.
• If Microsoft or Google sign-in stops working, an admin can sign in with their password and two-step code and click Turn off company sign-in on that screen. No two-step code set up? Email hello@suppliervault.co.uk and we'll help.

Only staff of your company

Under Company sign-in only, you can lock sign-in to your own Microsoft tenant or Google Workspace domain with Lock to my company's account, or add a tenant ID or domain and select Add. Other companies' work accounts then can't get in, even with an invitation. See Sign in with Microsoft or Google.

Add and remove people automatically

On the Enterprise plan, connect your IT team's Microsoft Entra ID or Okta so people are added when they join and lose access the moment they leave. Choose the role new people join as (New people join as), the email domains allowed (Only these email domains), then Turn on and make a token. Show people added this way lists them. See Add and remove people automatically.

Two-step sign-in for everyone

Tick "Require two-step sign-in for everyone in" your organisation. Turn it on for yourself first: SupplierVault won't let you require it until your own session used it. People without it are asked to set it up the next time they sign in, and can't see or change anything until they do.

Accounting software

Admins can connect Xero, QuickBooks Online, Sage Accounting, Sage 200 or Microsoft Dynamics 365 Business Central here, so SupplierVault reads supplier bills and credit notes every morning, read only. Each connection has Choose what to read and Check matches. Until a connection is enabled for the service it says, for example, "The Sage 200 connection isn't switched on yet." See Connect your accounting software.

Custom roles

Admins can make their own roles, such as Finance or Requester, by choosing what each may change, then give them to people in the Team tab. See Custom roles.

Your data, API keys and organisations

• "Download all data": a zip of every record, the full change history, the team list and uploaded files. See Security and your data.
• "API keys": see The API.
• "Switch organisation" (if you belong to more than one), "New organisation" (you can be admin of up to 5) and "Leave".

Close this organisation

Admins only. This permanently deletes every supplier, record, file, the change history and the team. Download your data first. Type the organisation name, click "Close organisation", then click again to confirm. It can't be undone. Our terms explain that data is deleted within 30 days and backups are overwritten within 7 days after that.

The "Group" tab

For groups of companies, multi-academy trusts and federations. A group organisation creates a join code; each company's admin enters it here to join, and the group can then see a read-only summary of that company's suppliers. The tab shows whether your organisation is part of a group, or the companies in your group, and lets admins join, leave or remove companies. Groups are in the Enterprise plan. See Groups of companies.

Weekly email, team mailboxes and Microsoft Teams

In the You tab, anyone can switch on Weekly email: Your week in SupplierVault, off until you tick it, and Preview what it would contain. In the Organisation tab, admins can add team mailboxes (each must confirm through a link emailed to it before anything else is sent) and post to a Microsoft Teams channel. See Weekly email and Microsoft Teams posts.

Single sign-on (SAML)

On Enterprise (not the free month), admins can ask for single sign-on with your own identity provider in the Organisation tab, under Single sign-on (SAML). See Single sign-on with SAML.

Document storage

The Plan tab shows how much document storage your organisation has used, for example "2.1 GB of 25 GB used by 12 uploaded files". Links don't count. See Documents.

Related

• Inviting your team
• Plans and billing
• Security and your data
• Settings
• Sign in with Microsoft or Google
• Custom roles
• Groups of companies
• Connect your accounting software
• Add and remove people automatically
• Weekly email and Microsoft Teams posts
• Single sign-on with SAML