Client access and payment

In the third step of this guide, we covered the benefits of accessing a Site as a full Organization Member, as an Organization Member invited via Site Sharing, and through a Guest Password on a Site with Guest Access enabled. You don't have to use the same approach for every client, but some methods are better suited to Sites stored in a Client Organization versus your agency's Organization.

Which method suits your client depends on where their Sites live and whether they want a CloudCannon account:

• If your client's Sites are in a Client Organization, invite them as an Organization Member of that Organization. This is the only method where your client can receive and pay their own invoices.
• If your client only needs one Site, use Site Sharing to invite them as an Organization Member with access scoped to that Site, so they never see anything else in the Organization that holds it. This works whichever Organization the Site is in, and is the simplest way to give a client access to a Site in your agency's Organization. If that Organization uses the Team Plan or Enterprise Plan, you can use Custom Permission Groups instead to control more precisely what each client can reach.
• If your client does not want a CloudCannon account at all, turn on Guest Access for their Site and give them the Guest Password. This works whichever Organization the Site is in, but everyone who uses that password shares one identity, so you cannot tell who made a change.

Invite a client as a full Organization Member#

When you invite a client to an Organization, you must add them to at least one Permission Group. Permission Groups determine what an Organization Member can see and interact with in CloudCannon.

Every Organization has the same five Default Permission Groups on every Subscription Plan: Owners, Developers, Technical Editors, Editors, and Billing. A Client Organization also has the Partner Permission Group, which is where your agency's own access comes from. A person can belong to more than one Permission Group.

These are the three most common Permission Groups combinations you might invite your client to:

• Owners — Your client can do everything you can, including managing Organization Members, changing Organization settings, and deleting the Organization. This is a good option for technical clients or Organization handovers. Only members of the Owners and Partner Permission Groups can add someone to the Owners group, so if you are in a different group, ask an Owner to send this invitation.
• Editors and Billing — Your client can edit and publish content and manage their own billing, but cannot change Site or Organization settings, or manage their team. This option allows your client to pay for their CloudCannon invoice directly and contribute non-technical changes to their Site, without ending your management of the Organization.
• Billing — Your client can pay and nothing else. This option is for members of your client's team who need to manage payment details but not contribute to content.

Handing over control does not remove your agency's access. Your agency's Owners keep full access through the Partner Permission Group, without using a Seat on your client's Subscription Plan.

To invite a client as an Organization Member, open their Client Organization first by clicking the Clients link in the App Sidebar, then your client's Card in the Client Organizations Browser. Then click the Org Settings link in the App Sidebar and open the People page.

On the Members tab, click the Add Members button to open the Invite Organization Members modal. Enter your client's email address in the Email address field, search for and select the Permission Groups you decided on in the Groups field, and click the Add Member button to send the invitation, or the Add Members button if you entered more than one email address. CloudCannon emails your client, and asks them to create an account if they do not have one. To send your client instructions for their side, please read our documentation on joining or leaving an Organization.

View CloudCannon using your client's permissions

Once your client has accepted their invitation, you can confirm you picked the right Permission Groups using View As mode, which loads CloudCannon with their exact permissions.

On the Members tab, click the Context Menu icon on your client's Card and select the View as [Organization Member Name] option. CloudCannon will open a modal explaining what the mode does. Click the View as [Organization Member Name] button in the modal, and CloudCannon will reload the app with your client's permissions.

While the mode is on, you can explore your Organization from the perspective of your client. Links and buttons for actions your client's Permission Groups don't allow are hidden or disabled. If you navigate to a page directly via URL, CloudCannon shows a permission denied message instead.

CloudCannon pins a Viewing as [Organization Member Name] banner to the top of the page with a Stop button.

This mode only changes what you can interact with. Any change you make is still recorded under your own name, so use it to check access rather than to work on your client's behalf. Navigating away from the Organization or logging out ends View As mode, as do the Stop button and the Stop viewing as [Organization Member Name] option in your user menu at the bottom of the App Sidebar. For more information, please read our documentation on viewing your Organization as an Organization Member.

Invite a client to one Site as an Organization Member#

Site Sharing gives your client their own CloudCannon account with access to a single Site, so they never see anything else in the Organization that holds it. Every Site has its own Site Sharing Permission Groups, whether it sits in your agency Organization or a Client Organization.

As with inviting a client as a full Organization Member, inviting them using Site Sharing requires you to add them to at least one Permission Group. CloudCannon provides two Site Sharing Permission Groups per Site: [Site Name] Editors and [Site Name] Technical Editors.

These Permission Groups contain broadly the same permissions as their Organization-wide counterparts, but scoped to a single Site.

• [Site Name] Editors — Your client edits content, uploads images, and reads form submissions. They cannot open the Source Editor, so they never see raw Markdown or YAML. This suits most clients.
• [Site Name] Technical Editors — Everything above, plus the Source Editor, site analytics, and control over builds, backups, and Build Deploys. Choose this for a client who is comfortable in raw files, or who wants to see their own traffic figures.

Clients invited this way use one Seat on the Subscription Plan of whichever Organization holds the Site. You can invite a client to several Sites in the same Organization without using more than one Seat. They cannot receive or pay their own invoices through Site Sharing, because they are a member of one Site rather than of the Organization that bills for it.

To invite a client as an Organization Member via Site Sharing, start in the Organization that holds their Site. If the Site is in a Client Organization, open that Organization first by clicking the Clients link in the App Sidebar, then your client's Card in the Client Organizations Browser. Click the Sites link in the App Sidebar and open the Site you want to add them to by clicking on it in the Sites Browser.

Click on the Site Settings link in your Site Navigation and navigate to the Site Sharing page, which lists everyone who can already reach this Site and the Permission Group each belongs to.

Click the Add Members button to open the Invite Organization Members to your Site modal. Enter your client's email address in the Email address field, choose the Permission Group you decided on in the Group dropdown, and click the Add Member button to send the invitation. CloudCannon emails your client, and asks them to create an account if they do not have one. For your client's side, please read our documentation on joining or leaving an Organization.

Once your client accepts their invitation, you can check their access with View As mode. On the Site Sharing page, click the Context Menu icon on your client's Card and select the View as [Organization Member Name] option.

Enable Guest Access for a Site#

Guest Access suits a client who edits rarely and does not want another account to manage. Instead of an invitation, you set a Guest Password on one Site, and anyone with that password reaches a simplified version of CloudCannon for that single Site. The simplified CloudCannon UI has the Dashboard and Collections in the Site Navigation, but no File Browser or Site Settings. The App Sidebar holds no links to other Sites, Projects, or Domains, so the rest of your Organization and your other clients stay out of view. Your client sees the Organization's name and branding at the top of the App Sidebar, and a Sign Out link at the bottom.

By default, anyone who logs into a Site with a Guest Password will have the same permissions as the [Site Name] Editors group from Site Sharing: they can edit content, upload images, read form submissions, and publish to the live Site. On the Team Plan and Enterprise Plan, you can edit these permissions to create a custom set.

Each Site in your Organization with Guest Access enabled counts as one Seat in your Subscription Plan, although multiple people can use the Guest Password you create for that Site. If multiple people use the same Guest Password, you will not be able to determine who performed an action, as they will all share the same Guest identity in CloudCannon.

Guests cannot receive or pay their own invoices, because they have no CloudCannon account to bill. If your client wants to hold their own billing, they need to be an Organization Member of a Client Organization.

To enable Guest Access for a Site, start in the Organization that holds it. If the Site is in a Client Organization, open that Organization first by clicking the Clients link in the App Sidebar, then your client's Card in the Client Organizations Browser. Click the Sites link in the App Sidebar and open the Site you want to add them to by clicking on it in the Sites Browser.

Click on the Site Settings link in your Site Navigation and navigate to the Guest Access page, which displays a Guest Access is off Card.

Enter a password in the Password field and click the Set password and turn on button. CloudCannon will turn Guest Access on for this Site, and the Card will change to Guest Access is on above the address of the Guest Login Page your client uses.

Four tabs appear once Guest Access is on:

• Password — Replace the Guest Password at any time. CloudCannon stores the password encrypted and never shows it again, so keep your own record of it when you set it. If a client loses theirs, setting a new one is the only way to restore access. A new password stops the old one working for new sign-ins, but it does not sign out anyone who is already in.
• Author — Set the Git author name and email recorded against your guests' changes, available on the Team Plan and Enterprise Plan. The Git author name field defaults to CloudCannon and the Git author email field defaults to support@cloudcannon.com, and the committer stays CloudCannon whichever you set. Use this when a client's repository history needs to show who asked for a change.
• Permissions — Narrow what guests can reach, down to individual files with File globs. The scope is fixed to this Site, and editing the resources requires the Team Plan or Enterprise Plan, the same gate as Custom Permission Groups. On other Subscription Plans the tab shows the defaults read-only.
• Settings — Change the URL subpath your guests log in at, which defaults to update, and add Documentation URL and Support URL links to their sidebar so they have somewhere to go before they contact you. You can also check the Prevent password save prompt checkbox to stop the browser asking your guests to save the Guest Password when they sign in.

For more information, please read our documentation on what Guest Access is and enabling a Guest Password for a Site.

Remove a client's access#

When a relationship with a client ends, how you revoke access depends on the method you used to grant it.

• A full Organization Member — On the Members tab of the People page, click the Context Menu icon on their Card and select the Remove from Organization option. CloudCannon will ask you to confirm, and warn you that a current Organization Member must invite them to rejoin.
• A Site Sharing recipient — On the Site Sharing page under Site Settings, click the Context Menu icon on their Card and select the Remove from Site option. They keep their CloudCannon account and anything else they can reach.
• A guest — Click the Turn Off button on the Guest Access page. Guest Access has no way to revoke one person, so this ends it for that Site and signs out everyone using the Guest Password. Setting a new password instead stops the old one working for new sign-ins, but leaves anyone already signed in where they are. If one person needs to lose access while the rest keep theirs, use Site Sharing, where each client has their own account to remove. To find every Site with Guest Access turned on, open the Guests tab on the People page and click a Site's Card to open its Guest Access page.

Removing someone frees the Seat they were using on that Organization's Subscription Plan, once they have no other access in that Organization. Turning off Guest Access frees the Seat that Site was using.

Choose who pays for your client#

Once your client's Site is created and they have access, you can choose who pays for their work on CloudCannon: your agency, with the cost folded into your existing billing structure for clients, or the client directly.

Each Organization has its own payment method, and members of the Owners and Billing Permission Groups can edit payment details. A Client Organization also has the Partner Permission Group, so your agency can edit them there too. If you want your client to pay their invoice directly, you must have set up a Client Organization and invited them as a full Organization Member.

Adding a payment method works the same way in every Organization, so you can follow these steps yourself or send them to your client to follow in their own Client Organization.

Click the Org Settings link in the App Sidebar and open the Subscription page. Scroll to the Billing Details section and click the Add Credit Card button to open the Add your Credit Card modal.

Enter the card details and click the Add Credit Card button. CloudCannon will confirm the card with the bank and attach it to that Organization. Some banks need a billing address before they will approve a card, so if a payment is declined, expand the Additional info section in the modal and add the address, city, state, postal code, and country.

Once an Organization has a card, the button becomes Manage Credit Cards, which is where you replace a card or remove one you no longer use.

To add your agency's card to a Client Organization, open that Organization first by clicking the Clients link in the App Sidebar and then your client's Card in the Client Organizations Browser.

Who pays and who receives the invoices are separate choices. CloudCannon emails invoices to the address in the Billing Email field, which you reach by clicking the Update contact info button in the Billing Details section of the Subscription page. This means you can send a client's invoices to them while your card covers the cost, or the other way around. For more information, please read our documentation on adding billing contact information and managing your payment methods.

Keep an eye on your client's billing

Handing a client their own billing does not mean losing sight of it. CloudCannon runs Health Checks across every Client Organization you manage and reports them on the Health tab of your Partner Organization's Organization Home page, so a client whose payment fails surfaces on your dashboard rather than only on theirs.

Two of those checks concern billing. Subscriptions need attention is a Danger check that counts Client Organizations whose Subscription is overdue, unpaid, or paused, any of which can put that Organization on hold. Free Trials are ending soon is a Warning check for clients whose trial ends in the next few days without a Subscription Plan chosen.

Each check lists the affected clients by name. Click the link for a Client Organization to open the Health tab on its own Organization Home page, where the specific problem and the link to fix it appear. You can also filter for these clients directly in the Client Organizations Browser.

Enable Overages for your clients#

Earlier in this guide, we covered extending a Subscription Plan with Add-Ons and Overages, and recommended turning Overages on for every Organization you manage so that reaching a Build Time or Hosting Bandwidth limit never takes a client's website offline. Now that you have decided who pays, you can turn them on for each Client Organization.

Your agency's own Organization already has Overages turned on, unless you switched the toggle off when you completed checkout. A new Client Organization starts with Overages turned off. The steps below work for either, so you can also use them if you switched Overages off for your agency's Organization and want them back.

To turn Overages on for an Organization, click the Org Settings link in the App Sidebar and open the Subscription page. If you are enabling Overages for a Client Organization, open that Organization first by clicking the Clients link in the App Sidebar, then clicking your client's Card in the Client Organizations Browser.

While Overages are off, CloudCannon shows an Overages are disabled warning, telling you that CloudCannon will stop serving webpages to visitors if you reach your Hosting Bandwidth limit. On a Subscription Plan with a Build Time limit, such as the Lite Plan, it also tells you that your changes won't appear on your live Site if you reach that limit.

Click the Enable Overages button. CloudCannon will open the Your Subscription Plan page with the Overages toggle already switched on, so you can confirm the change before it takes effect.

Turning Overages on does not charge you immediately. Instead, you are enabling CloudCannon to invoice you for usage above your Subscription Plan limits each month, so a charge will only appear on your invoice in a month where you go over one. Click the Enable Overages button to confirm.

CloudCannon will return you to the Subscription page, where the warning is replaced by an Overages are enabled confirmation.

Turning Overages off again takes a different route, because the confirmation carries no button. On the Subscription page, click the Review your Subscription Plan button, click the Overages toggle to switch it off, then click the Disable Overages button that appears. CloudCannon will not let you turn Overages off while your usage this month is already above a Subscription Plan limit.

In the next step of this guide, we'll move a client's Sites between your own Organization and a Client Organization when their needs change.