Configuring your server

Your organisation's administration: its settings, its people, its plan and its workspaces. In Joripo 2.0 it is all under Configure (the gear on the left): Server settings, People, Plan & usage, API tokens and computers, and each workspace's settings. The account menu (your initials, top right) holds only your own things: theme, password, Joripo Desktop, help and sign out. In the Legacy console it is all on the Configure tab.

Organisation

Server settings › Server: an owner renames the organisation here. Its server name (what everyone signs in with, and phones were set up with) and the address phones connect to are set by the server's maintainer.
Plan & usage (owners and managers): your plan, its limits, and what you use of each, measured now (see Usage and limits below).
Upgrade or buy a subscription (on Plan & usage): choose a plan to tell the Joripo team which one you want. Joripo takes no payment online: the team agrees the terms with you and then sets the plan on your organisation. Compare plans opens the pricing page.
Activity log (owners and managers): who did what, and when (see below).
API tokens and computers: your own tokens for pulling data with a script, and the computers running Joripo Desktop as you. A token is shown once, when it is made; revoke one you no longer use.

Usage and limits

Configure › Plan & usage shows, for each limit, what is used, the limit, what is left and a bar, with a state: within the limit, getting close (from 80% of it), nearly at the limit (from 95%), at the limit or over the limit. A number the server cannot measure says Not measured, never 0. The server's maintainer can change where the warnings start (USAGE_WARN_PERCENT, USAGE_CRITICAL_PERCENT).

Forms is a firm limit: at it, uploading a new form is refused, with the reason. New versions of the forms you have are always accepted. The upload panels say how many forms are in use before you upload, from 80% of the limit, and that a new one will be refused when the limit is reached. To add one, delete a form you no longer need (Design › the form › Delete), or choose a larger plan on this page. Forms in deleted workspaces don't count; restoring a workspace counts them again.
Devices is a firm limit: Joripo Collect phones approved and signed in. At it, a new phone's sign-in is refused (the phone says why) and a waiting phone cannot be approved; the phones you have keep working, and one signing in again is never refused. Revoke a phone no longer used on the Collect tab to free its place.
Workspaces is a firm limit: at it, a new workspace, or restoring a deleted one, is refused. Forms outside every workspace and deleted workspaces don't count.
Submissions this month and Storage (your plan) are recorded limits: past them nothing is refused -- submissions and uploads keep arriving -- and the overage is recorded for your plan. On a paid plan, extra submissions you have bought are used first, only once the month's own are used up; Plan & usage shows how many are left. Ask the Joripo team to buy more: they are added once paid. Purge data you have exported and no longer need (Collect › a form › Purge), or choose a larger plan.
On the Free plan, quality checks and dashboards take in your organisation's first 200 submissions of each calendar month. Later ones are still accepted, kept and exported, just not checked; Plan & usage says how many. Garbling and audio audit are on paid plans: on Free a garbling scheme cannot be started or frozen (one frozen before keeps garbling its form until it is closed), and a form with an audio audit (or background audio) cannot be deployed.
Submission attachments and Server datasets are parts of your storage, shown so you can see where it goes.
Server storage space is not a plan limit: it is the disk of the server itself, shared by every organisation on it (on a hosted server, its storage volume). When it is full, uploads and submissions fail for everyone until space is freed. The upload panels warn when it is nearly full; tell the server's maintainer.

Activity log

Configure › Activity log lists what was done in your organisation, newest first: changes to the case list and to each case (from uploads, from submitted data, assignments, rounds, reviews), flag reviews, garbling (opening the vault, exporting or destroying a key, downloading a roster), identifying datasets opened, privacy and identity access, forms moved, phones and device keys, workspaces, and -- for owners -- people, roles, sign-ins, API tokens and the organisation's settings.

Owners see every event of the organisation. Managers see the events of the workspaces they manage, and none about people, sign-ins, tokens or the organisation's settings. Reviewers and data collectors do not have this page.
Filter by workspace, kind, person (part of an email), from and to dates (whole days, UTC) and outcome (done, refused, failed). The filtered view is a link you can share with another owner or manager; it shows 50 events a page.
Download (.csv) gives the filtered events, up to 10,000 at a time, with the same words as the page. Each download is itself in the log.
What the server's maintainer (the Joripo team) did to your organisation shows as Joripo server maintainer. Network addresses are never shown.
A case list marked as holding identifying data keeps its case IDs, labels and values hidden here from anyone without identity access to that workspace; a flag review's note shows only to people who see respondents' identities there.
Nothing in the log can be edited or deleted, from here or anywhere else.

Workspace settings

Each workspace's Settings page (owners and managers) holds:

its name and time zone. Renaming moves no data;
Archive: when the fieldwork is over. Phones and web forms can no longer send to it (unsent forms stay on the phones); everything in it can still be seen and exported. Restore makes it active again. A workspace the server's operator suspended or archived is restored only by them;
Delete (owners, by typing the workspace's name): it leaves every list, nobody can open it and phones and web forms are refused, but nothing is erased. An owner restores it, with everything in it, from Workspaces › Deleted workspaces.

External access

A workspace's External access page (owners and managers) shares that one workspace with someone outside your organisation: a client, funder or partner. Each person gets a role (viewer, data downloader, data manager, or form and data manager) and a password of their own; signed in, they see only what is shared with them. Your own team is never added here: who works in which workspace is set on People.

Inviting people by e-mail

Type one e-mail address; Add another address gives another field, up to five at a time. Choose their role, then Send invitations.

Each person gets an e-mail with a link that works once and ends after 7 days. The e-mail never contains a password.
When they open it, Joripo sends a 6-digit code to that address first, so a forwarded invitation opens nothing. They then choose the password they will sign in with, and are signed in to this workspace only.
The page says what happened to each address: Invitation sent when the mail service accepted it; Not sent with the reason when it did not -- then the link is shown to you, once, to pass on yourself; Not invited when the address is not one, is someone of your own organisation, already has access, already has an invitation waiting, or there is no place left.
Invitations lists every invitation with its state (waiting, accepted, revoked, ended). Revoke stops a waiting one at once.
A waiting invitation holds one of the workspace's places until it is accepted, revoked or ends.
This server sends e-mail only when its maintainer has set it up: MAIL_FROM and one of RESEND_API_KEY, BREVO_API_KEY or SMTP_HOST (with SMTP_PORT, SMTP_USERNAME and SMTP_PASSWORD). Until then every invitation says Not sent and shows its link; such a link is accepted without a code, so give it only to the person invited.

Places and changes

A workspace is shared with at most 5 people at once (unless the server's maintainer set another number). The page shows how many places are taken, counting invitations still waiting (for example 3 of 5 people); when all 5 are taken, the form is closed, and the server refuses a sixth person however the request is made. Revoke someone (or a waiting invitation), or wait for an access to reach its end date, to free a place.
Changing the role or end date of someone who already has access (Change role or end date under Who has access), or making them a New password, takes no new place, so it works on a full workspace too. A person whose account was turned off still holds their place: turning it back on gives their access back.
A workspace that was shared with more than 5 people before this limit keeps every one of them: nobody loses access. It takes nobody new until fewer than 5 have it, and the page says so.
Create workspace can invite up to 5 people to the new workspace at once, in the same way.

Server settings

One setting at a time:

Server: your organisation's name, its server name, its sign-in address and the address phones and web forms reach this server at. That address is one setting for the whole server, set by its maintainer; it is shown here so you can check it.
Login: the password rules. Passwords are at least 12 characters (4 for a data collector) and do not expire. Every password field (sign-in, sign-up, setting up the server, changing your password, setting someone else's, the maintainer's sign-in) has an eye button, Show password, that shows what you typed; it hides again when the form is sent.
Access (owners change it): Restricted workspaces. On, managers and reviewers see only the workspaces they are assigned to on People, and the Data Explorer, exports, attachments and the API follow; off, they see every workspace. Owners always see everything. ODK Collect sign-in with email and password: on, ODK Collect can be set up with the server URL shown there and a person's email and password, over https only, instead of a device key's QR code.
Notifications and Interface language say what is available on this server today.

In the Legacy console, Storage and Subscription show what Plan & usage shows in Joripo 2.0.

Your workspaces

A workspace owns a set of forms, its own device keys and its own data; nothing crosses between workspaces. Add workspace creates one (owners and managers), and Open switches to it.

Roles and permissions

Owner: everything in the organisation, including its people. Several people can be owners; one always remains.
Manager: workspaces, forms, datasets, device keys, phone approval, quality checks, quotas and exports.
Reviewer: reads data and reviews quality flags.
Collector: collects with Joripo Collect or web forms, and has no console.

Your users

Owners manage the people in the organisation, on People (Joripo 2.0) or Configure › Your users (Legacy console):

Add a user with an email, a role and a first password, and pass the password on. The password is temporary: at their first sign-in they choose their own. Untick They choose their own password to let them keep it; it starts unticked for a data collector, because Joripo Collect cannot change a password (a collector who must choose one is told on the phone to sign in on the web first).
Edit changes someone's role or the name shown for them, or sets a new password (entered twice). A new password works the same way, and it signs the person out of every browser and revokes their API and Joripo Desktop tokens.
Password reset requests appear here when someone uses Forgot password? on the sign-in page. When the server sends e-mail, people who sign in with an email address get a reset code by e-mail instead and never appear here; usernames and servers without e-mail still ask you. Set a new password opens that person's password form, and you give them the new password directly; that closes the request. Dismiss closes it without a change.
Deactivate signs a person out for good and revokes their phones; setting a new password reactivates them.
Edit › Workspaces chooses where a person works: every workspace (the default, including ones added later) or the ones ticked. A data collector's phone gets keys, and their web forms open, only for those workspaces; a key for a workspace taken away stops at once and works again if it is given back. With Restricted workspaces on, managers and reviewers see only theirs too, and a manager can be given a narrower role in one workspace: Reviewer only (reads, changes nothing) or Data collector only (collects, sees no data). If that manager is later given a role the limit does not fit (a reviewer, who does not collect), they stop working in that workspace, and the role change says so. Add a user offers the same choice. A deleted workspace is not listed here, and saving changes nothing about it: whoever worked in it when it was deleted (on every workspace too) keeps their place in it, even if moved to ticked workspaces since, so restoring it brings them back as they were. Someone who was not in it when it was deleted, or was added after, is not given it by a restore while they are on ticked workspaces.

An owner can step down once another active owner exists; nobody can remove the last one.