Editing and removing staff
What this covers
Changing someone's details or role, removing an account, and what to do when a member of staff leaves.
Requires the manage-users permission.
Editing an account
From Property Settings → Staff, open the person and change any of:
- Name
- Email — still must be unique within your restaurant. Changing it changes how they sign in, so tell them
- Role — takes effect immediately
- Password — leave it blank to keep the current one, or set a new one
Changing a role takes effect at once
Promote a Host to Manager and the new menu items appear for them; demote someone and the pages they used to reach start refusing. If they are signed in at the time, they may need to reload the page before the menu catches up.
Nothing they created is affected. A booking taken by a Host is still their booking after they become a Manager.
Setting a password for someone
Useful when someone is locked out of their email or has simply forgotten. It also clears any lockout on the account, so it doubles as an unlock (link Unlocking a locked-out account).
The new password must satisfy the usual rules, including not repeating one that account has used recently (link Password requirements).
Finding someone
The list is searchable and paged, which matters once you have twenty accounts. Search by name or email.
Removing an account
Deleting a staff account removes the person's access immediately and permanently. There is no deactivated state for staff — unlike tables, an account either exists or is gone.
What happens to their work
Everything they created stays. Bookings, guests, waitlist entries, bills — all of it remains exactly as it was. Deleting an account does not delete a single record.
One detail worth knowing: records they created stop naming them. A booking created by someone you have since deleted keeps every other detail but no longer shows who took it. So if attribution matters to you — you are investigating something, or you want a record of who did what — read the audit log before deleting the account, because the link is not recoverable afterwards (link The audit log).
Two deletions that are refused
| You cannot delete | Why |
|---|---|
| The Owner | It is your billing identity. To close the account, cancel the subscription instead (link The Owner account) |
| The last remaining account | An empty staff list would lock the restaurant out permanently — nobody could sign in, and no password reset would work |
Both refusals explain themselves on screen. They are guard rails, not bugs.
When someone leaves
A short checklist. The first item is the one that gets forgotten.
- Delete the account the day they leave, not the next time you think of it. An account nobody is watching is the one that gets used.
- Change any shared passwords they knew — and if they had your Owner login, change that immediately (which is one reason not to share it).
- Rotate anything they had access to, if they were a Manager or Owner:
- API keys — revoke and reissue (link API keys)
- Phone trigger URLs — revoke and create new ones, remembering to update your phone system too (link Connecting your phone system)
- Webhook endpoints, if they pointed anywhere they controlled (link Webhooks)
- IP allowlist bypass codes they were issued (link Bypass codes)
- Check the audit log for anything unexpected in their last few shifts — not because you assume the worst, but because it is much harder to reconstruct later (link The audit log).
- Reassign their duties, especially if they were the only Manager. Being left with one Owner and nobody else who can cover is a bad position to discover during service.
Being unsentimental about step 1 is the whole point. A departing member of staff with a working login and a grudge is the most likely security problem a restaurant will ever have, and it costs nothing to prevent.
Good to know
Deleting frees a slot against your plan's staff limit immediately (link Adding staff accounts).
You cannot delete yourself from here — that is on your own profile page, and it is subject to the same two guards.
Removing an account does not cancel their bookings. Guests are unaffected and nothing is sent to anybody.
A deleted account cannot be restored. Recreating a person means a new account; their old records stay unattributed.