Administration

The Admin area is where organization owners and admins set up Crewhall for everyone: members, spaces, brand, security policies, integrations and modules. Open it from the left menu. Other members do not see it.

Who can do what​

Crewhall has two kinds of roles. An organization role applies to the whole workspace. A space role applies inside one space.

A few rules follow from this:

• Org admins do not see the content of a space by default. To see it, they add themselves to the space, and that is recorded.
• Admins can't see the content of personal spaces.
• A member can give another person at most their own space role.
• Sharing a file or folder can only widen access, never narrow it.
• A guest has the Viewer or Editor role in the spaces chosen for them.

Organization​

General​

Organization name, Organization ID (used by the API and exports; it can't be changed) and Default language. Under Policies:

• Require two-step verification. Members without it can't enter the app. Owners and admins always need it.
• Members can create spaces. When off, only admins open spaces.
• Public links. When off, nothing can be shared outside by link.
• Delete chats for everyone and Remote control in meetings.
• Trash retention. Trashed items are deleted for good after this many days (1-3650).

The Modules card on the same page turns modules on and off. A disabled module disappears from the menu and the mobile app, and its endpoints stop answering. Drive and quick access are core modules and are always on. You can switch off Chat, Meetings, Pages, Boards, Drawings, Vault, Portal, MCP and API, Forms and surveys, Calendar, Directory, Tables, Automations, AI, Mail, Tools and Office.

Members​

The list shows each person's organization role, 2FA status, last seen time and status. Filters: All, Admins, No 2FA, Invitations, Suspended.

To invite people:

1. Select Invite.
2. Paste or type the email addresses.
3. Choose the organization role and the spaces they join.
4. Send the invitations. They are valid for 7 days.

Addresses outside the organization's domain are invited as guests and see only the selected spaces. If email is not set up, Crewhall shows invitation links that you send yourself.

Select a member to open their panel. There you can change the role, set an end date for a guest, and Suspend them. Suspending ends their sessions and blocks sign-in; their content stays in the spaces. Reactivate lets them sign in again. If a person is locked after repeated failed sign-ins, Unlock lifts the lock. Push diagnostics show why a notification did or did not reach their devices.

Spaces​

An overview of the shared spaces: members, storage, your role, owner and status (Active, Archived, Quota warning). Space roles are managed in each space's own settings.

Statistics​

Active users per day, week and month, total storage, module usage, growing spaces and the people using the most storage. Figures come from an hourly summary. Select Update now to refresh.

Notification delivery​

How email and mobile notifications leave the organization. For email, choose the server default, your own SMTP server or Notifike. For mobile push, choose the server's Firebase account, your own Firebase project (upload the service account JSON) or Notifike. Save first, then use Send test e-mail and Send test notification.

Brand and theme​

Crewhall is white-label. The product name stays in the background.

• Brand: Organization name, App name, logos for light and dark backgrounds, a square emblem, the favicon, and whether to show the "with Crewhall" line on the sign-in page, in email footers and in About.
• Theme: background, surface and accent colors for the light and dark themes. Other tones are derived. Pick a theme set or set colors yourself. A contrast check enforces at least 4.5:1 for text; a failing theme can't be published, and Fix automatically offers a correction. You can also set the corner radius and the default density, and import or export a theme as JSON. Published versions are kept.

Security​

Security policies​

• Authentication: Require two-step verification, Sign in with a passkey, and "Remember this device for 30 days".
• Password policy: Password sign-in (when off, members use SSO or the directory; the owner keeps a password), Minimum length and Breached password check. The check uses k-anonymity, so the password never leaves the server.
• Session: Session length, "Keep me signed in" length and Failed sign-in lock. Consecutive locks double in length.
• IP allowlist: add addresses or CIDR ranges with a label. Choose Off, Admin area (only admin screens are limited) or All sign-ins. The page tells you whether your own IP is listed.

SSO apps​

Crewhall can act as an OpenID Connect provider, so people sign in to other apps with their organization account. Select Add app and choose the type: Web (confidential client with a secret), SPA or Mobile / desktop (public clients with PKCE). Enter exact redirect URIs. Choose who can sign in and whether guests may use it. The client secret is shown only once. The page also shows the issuer, discovery address and signing key, which you can rotate.

Compliance​

• Retention: how long chat messages and the audit log are kept. The audit log is kept at least a year.
• Data loss prevention (DLP): rules for card numbers, Turkish ID numbers, IBANs or a custom pattern. Warn asks for confirmation in chat; Block does not send the content.
• Legal hold: the selected people's content and the selected spaces are never deleted by any cleanup until the hold is released.
• eDiscovery export: collect chat, pages, board cards, files and audit entries of selected people and spaces into one ZIP. It can be downloaded for 7 days.

MCP and API​

Organization policy for AI clients and personal tokens: whether the MCP server and tokens are on, whether guests may connect, rate limits, token lifetime, which clients are allowed, and which actions require human approval. See Plugins and MCP.

Federation​

Federation lets people chat and share with other Crewhall installations. Turn it on, compare the key fingerprint with the other admin, add allowed domains, then add a peer. The peering becomes active once both sides add each other. Shared channels and their file limit are set here too.

System​

Plugins​

Install, update, turn off and remove plugins, and choose which permissions each one gets. See Plugins and MCP.

Integrations​

• Identity providers: sign in with Keycloak, Microsoft Entra ID, Google Workspace, Okta, generic OIDC, SAML 2.0, Active Directory or OpenLDAP. For each provider you can set email domains, Require SSO, account creation on first sign-in, role mapping from groups, and an hourly directory sync that suspends people removed from the directory. Test checks the connection without signing anyone in.
• Microsoft 365 integrations: provisioning from Entra ID (SCIM), the Outlook add-in, the Teams app, and external storage from SharePoint and OneDrive. Each is switched on separately.
• Office: connect a document server to edit Word, Excel and PowerPoint files in Drive. See Self-hosting.

Backups​

Turn on the nightly backup and set the time, time zone and how many nightly backups to keep. Back up now starts one at once. Restoring is done on the server with the crewhall command. See Self-hosting.

Desktop releases​

Upload the Windows installer (.exe) or the macOS update archive (.zip) and disk image (.dmg), then Publish. The desktop app takes its updates from your server and only updates to a newer release.

Module settings​

These pages appear only while their module is on.

• AI: choose the provider (Claude, ChatGPT, Gemini, Mistral, Azure OpenAI, OpenRouter or your own OpenAI-compatible server), the model and the API key. Set monthly quotas per person and for the organization. Meeting notes need a speech recognition server. Vault content is never sent to a model.
• Mail server: IMAP and SMTP settings for the Mail module, with presets for Microsoft 365 and Google Workspace and OAuth2 sign-in.
• Calendar: OAuth clients so people can connect Google Calendar or Microsoft 365 calendars.
• Rooms and desks: meeting rooms and shared desks people can book, with location, capacity, equipment and optional check-in. See Calendar.