Administration Guide
Support reference for tenant administrators and platform operators: profile versus settings separation, admin-center workflows, governed review queues, integration posture, GDPR compliance, and platform escalation.
User Management
All tenant user accounts are now managed from Admin Center → User Access. Administrators can invite new users, adjust account status, and assign roles and territories without mixing those actions into personal settings.
Inviting a New User
- 1Open Admin Center → User Access.
- 2Enter the user's email address.
- 3Select a role: Administrator, Manager, Medical science liaison, Representative, or Read-only.
- 4For REPs, select the assigned territory.
- 5Click Send Invitation. The user receives an email with a temporary password link valid for 72 hours.
Account States
User can log in and use all features permitted by their role.
Invite sent but the user has not yet completed first login.
Account is blocked. The user cannot log in. No data is deleted.
Deactivating a user from Admin Center → User Access immediately blocks login access. All historical data created by the user is preserved and remains visible to managers and administrators.
Role Assignment
FieldOrchestrator uses five fixed application roles: Administrator, Manager, Medical science liaison, Representative, and Read-only. Delegated enterprise-global or country-admin scope is layered onto administrator accounts rather than introduced as a separate base role.
Full administrative access. The same administrator account can operate with enterprise-global or country-admin scope when delegated enterprise grants are present.
- Manage users, roles, and seat posture
- Operate compliance and governed review paths
- Work with enterprise-global or country-admin delegated scope
- Open governed review queues
Operational management access. View territories in scope, generate and approve routes, manage HCPs, and access team analytics.
- View territories in assigned scope
- Generate and approve route plans
- Manage HCP records
- Access analytics and reports
Medical-facing access for scientific exchanges, scientific footprint review, and governed insights. Visibility stays limited to permitted medical evidence.
- Review medical exchange history
- Access governed scientific context
- Export permitted medical evidence
Mobile-only field access for the assigned territory. Reps can capture visit execution, outcomes, and offline sync but do not operate the broader admin surface.
- GPS-verified visit check-in and checkout
- Visit outcome and product capture
- Personal visit history
- Offline mode with automatic sync
Read-only access to dashboards and reports. Suitable for stakeholders who need visibility without write capabilities.
- View dashboards and KPI tiles
- Access generated reports
- Export data for offline review
API Key Management
API keys enable system-to-system integrations — such as ERP sell-out feeds and automated data pipelines — without exposing user credentials. Country and enterprise admins should treat key issuance as a governed handoff into platform backoffice rather than as a browser-side settings task.
Creating a Key
- 1First confirm that an API key is actually required rather than a managed connector path.
- 2Then hand off into platform backoffice with the integration context, intended owner, and required scope.
- 3Give the key a descriptive name (e.g. "Sage X3 Sell-Out Nightly").
- 4Select a scope: INGEST_SALES, SYNC_VISITS, or WORKFLOW_LOG.
- 5Store the one-time displayed key in a secrets manager; do not paste it into a tenant-visible admin surface.
The API key value is shown only once at creation time. If you lose the key, you must rotate it to obtain a new one. The old key remains valid for 24 hours after rotation to allow a seamless handover in running systems.
Available Scopes
| Scope | Authorized Operations | Typical Use |
|---|---|---|
INGEST_SALES | Import sell-out data from ERP or pharmacy data pipelines | Automated nightly ERP export feed |
SYNC_VISITS | Upload offline visit records from mobile devices to the platform | Mobile app background sync agent |
WORKFLOW_LOG | Write workflow audit events from external compliance or automation systems | External LIMS or document management integration |
Rotate a Key
Open the key detail view → click Rotate. A new key is issued immediately. The previous key remains valid for 24 hours.
Revoke a Key
Open the key detail view → click Revoke. The key is invalidated immediately. Any system using the revoked key will receive HTTP 401 errors.
Product Catalog
The product catalog defines the portfolio available to field representatives during visit capture. Navigate to Products to manage the list.
Adding a Product
- Name (displayed to field reps)
- Product code (used in sell-out data matching)
- Therapeutic area
- Active ingredient
Deactivating a Product
- Toggle the product to Inactive in the product detail view
- Inactive products no longer appear in new visit forms
- All historical visit records referencing the product are preserved
- Sell-out data already imported for the product remains intact
Sell-Out Data Import
Sell-out data is the foundation of the Visit Impact Score scoring and pre-call intelligence modules. Navigate to Administration → Sales Data → Import for manual uploads.
Supported Formats
CSV and XLSX files are accepted.
Required Columns
| Column | Type | Description |
|---|---|---|
hcp_code | string | HCP identifier — must match an existing HCP code in the platform |
product_code | string | Product identifier — must match a product code in the catalog |
brick_code | string | Geographic brick code for the sales area |
period | YYYY-MM | Reporting month in ISO year-month format |
quantity | integer | Units sold during the period |
value_tnd | decimal | Revenue in local currency for the period |
The system validates data quality on upload. Any rows with missing required columns, unrecognised codes, or invalid formats are listed with their row numbers in the validation report — the valid rows are still imported. For automated imports, use the INGEST_SALES-scoped API key (see API Reference).
GDPR Operations
FieldOrchestrator includes a full GDPR compliance toolchain accessible from the Compliance module and its governed GDPR workflows. All operations generate immutable, hash-chained audit records.
Erasure Request
Submit a dual-control erasure request for an HCP. The workflow requires three authorized users: a first to submit the request, a second administrator with the required delegated scope to approve it, and a third to execute the erasure. All three steps are logged with timestamps and user identities. This three-party control prevents unauthorized or accidental erasure of medical data.
Legal Hold
Flag an HCP record as under legal hold. While on hold, any erasure request for that record is automatically blocked. The hold must be explicitly released by an administrator with the required delegated scope before erasure can proceed. Legal holds are logged and cannot be silently removed.
Audit Log
A full chronological record of all data access and mutation events across the platform. Filter by user, date range, and action type. Export to CSV or XLSX for external compliance reporting. The audit log itself is append-only and cannot be modified or deleted.
Cryptographic Evidence Chain
Every GDPR operation (erasure request, approval, execution, legal hold, and hold release) is appended to an immutable SHA-256 hash-chained Evidence Chain. Each record includes the previous record's hash, making any retrospective tampering detectable. The chain is stored independently of the main audit log and can be exported as a signed JSON file for regulatory submission. Legal holds automatically block all erasure attempts — an administrator with the required delegated scope must explicitly release the hold before the three-party erasure workflow can proceed.
Data Retention
Visit logs and associated data are retained according to your organisation's configured retention window. The default window is 36 months.
Default Window
36 months
Applies unless your tenant's governed compliance policy has been changed by an administrator.
Purge Schedule
Nightly
Records outside the retention window are purged automatically during the nightly maintenance cycle.
Configuration
Compliance policy controls
Retention window can be extended or shortened by an administrator with the required delegated scope through the governed compliance operating path. Changes apply to future purge cycles.
System Health
System-health work is now split across the Admin Center, Review Workbench, integration posture, and platform backoffice instead of one overloaded legacy page.
Tenant-admin operating signals
- Pending user activations and seat pressure in Admin Center
- Governed review workload in the Review Workbench
- Connector posture and scheduler path in Integration Posture
- Compliance and engagement queue exceptions in their governed modules
Platform backoffice signals
- Pending platform approvals in platform backoffice
- Deployment heartbeat and silent/degraded sovereign runtime posture
- Recent sync failures and installation attempts for platform operators
- Step-up-protected operator grants and privileged actions
Need assistance?
Our support team is available Monday–Friday, 08:00–18:00 CET.