Accounts and roles

Kancil is single-tenant. One instance is one workspace, and everyone who can sign in is working inside it. There are no organisations, no teams and no per-record sharing rules to configure.

Signing in

You sign in with a username and password. The session lasts seven days, and it survives a browser restart — closing the tab does not sign you out.

Whether the sign-up link appears on the login screen depends on how the instance is configured. When self-registration is closed, an admin creates accounts for you; when it is open, anyone who can reach the login page can create one. A self-registered account always lands as a viewer.

Usernames are 3–32 characters of letters, digits, ., _ and -. Passwords must be at least 8 characters.

Two-factor authentication

You can turn on TOTP two-factor from Profile. Once enabled, signing in becomes two steps: password first, then a six-digit code from your authenticator app. You have five minutes to complete the second step before the challenge expires and you start over.

Enrolling produces a set of recovery codes. Save them somewhere that is not the phone holding your authenticator — they are how you get back in when the phone is lost, and they are the only way.

The two roles

Role	Can do
viewer	Everything the app is for: all records, all of Finance, all settings that belong to you.
admin	The above, plus the Admin section — users, database, locations import, mail filters, mail server, task history.

viewer is a misleading name inherited from the API: it is not read-only. A viewer creates, edits and deletes records exactly like an admin. The only difference is the Admin section, which is hidden from the sidebar and refused by the API.

Role changes take effect immediately, not at next sign-in — the server reads your role fresh on every request rather than trusting what was true when your session started.

What "yours" means

Records belong to the account that created them, and you see your own. The practical consequence is worth stating plainly: a record you cannot see and a record that does not exist are indistinguishable from the outside. Both give you a 404. If a colleague says they created something and you cannot find it, it exists — you are just not its owner.

Some things are deliberately shared across the instance rather than owned: the locations reference data (countries, regions, cities, languages), and the people records behind contacts, so that two people can link to the same person without duplicating them.

Your contact card

In Profile you can point Kancil at the contact in your own address book that represents you. That is what the "add myself" shortcuts use when adding you as an attendee, an activity participant, or a deal owner. It is optional, and nothing breaks without it — you just end up typing your own name more often.