Platform Admin Guide
This guide is for platform admins: Align's own operators, who run the service for every workspace. Workspace admins manage their own people and settings; see Team and Roles.
Who is a platform admin
An account is a platform operator if it has the platform_admin role or the Superuser platform role. Platform operators see a shield button, Platform Administration, at the top of the sidebar. It opens the console at /platform-admin. Anyone else who opens that address sees Access Denied.
The Users console and its user directory need the Superuser platform role, not only the platform_admin role. Only a superuser can grant the Superuser platform role, from Users → the user → Details → Platform Role (Cross-tenant).
No workspace can grant platform_admin to its members.
The console
| Page | What it is for |
|---|---|
| Dashboard | Operations overview: revenue, service health and partner activity, with links to anything that needs attention |
| Tenants | Every organisation on the platform; provision, archive, restore and delete; per-tenant feature flags |
| Users | Cross-tenant user directory, memberships, impersonation and GDPR requests (superuser only) |
| Revenue | MRR and ARR trends and subscription analytics |
| Service Health | The status of Align's internal and external services |
| Partner Submissions | Partner programme applications |
| Product Feedback | Feedback about Align from every workspace, waiting for review |
| MCP | MCP OAuth clients, tokens and tool usage |
| API Usage | Public API v1 usage, error rates and rate limiting |
| Security | High-severity audit events, new API keys and rate-limit violations |
| Audit Log | Every recorded platform action |
| Exports | CSV exports of platform data; each download is logged |
The Integrations page is not in the console menu. Open it from Integration connection errors on the Dashboard, or go to /platform-admin/integrations.
Provisioning a tenant
A tenant is a workspace: its own people, projects and billing.
- Open Tenants and click Provision tenant.
- Under Organization, enter the Name, choose a Plan, and choose the Type: Customer or Partner.
- Under First admin, enter their Email.
- Click Provision tenant.
Align creates the organisation with its plan subscription and usage counters, sets up its default email templates, AI tool settings and labour categories, and emails the first admin an invitation with the Admin role. That invitation is valid for 7 days. The admin chooses their own name and password when they accept.
When it finishes, the page says the tenant is ready, with Open tenant and Provision another. If the invitation email could not be sent, the page says so; the tenant still exists. If the invitation could not be created at all, Align removes the new organisation so you can try again from a clean state.
Each provisioning is recorded in the platform audit log.
Managing tenants
Tenants lists every organisation with its domain, status, plan, seats, health score and creation date. Filter by name or domain.
| Action | Available when | Effect |
|---|---|---|
| Archive | The tenant is active | Members lose access immediately. You type the organisation's name to confirm. |
| Restore | The tenant is archived | The organisation becomes active again and members can sign in. |
| Delete Permanently | The tenant is archived | Schedules the organisation and all its data for deletion. It cannot be undone. You type DELETE to confirm. |
Open a tenant to see its Organization Details, Subscription & Plan, Usage Counters, Tenant Health Score, Feature Flags and Users.
Feature flags
Feature flags switch platform capabilities on or off for one tenant. They are on the tenant's page under Feature Flags.
| Flag | What it enables |
|---|---|
| MCP Server | OAuth-gated MCP access for this tenant. See MCP Integration. |
| Max (AI Assistant) | The Max assistant. See Max. |
| Max External Writes | Lets Max propose and run actions in external systems. Needs MCP Server and Max on as well. |
| Public API v1 | The developer API and API key management |
| Time Tracking | Time entry and approval workflows |
| Replit Agent (OAuth) | Lets the tenant connect a Replit account and have Max send prompts to Replit Agent |
| Increments | The phase-level Increment board |
| Traceability | Requirements traceability and coverage tracking |
A change is saved as soon as you flip the switch. People already signed in to that tenant may need to reload the page to see it.
Enabling Max External Writes
- On the tenant's page, turn on MCP Server.
- Turn on Max (AI Assistant).
- Turn on Max External Writes.
Align checks the flags again when a person confirms an external action, not only when Max proposes it. If Max External Writes is turned off between the two, the confirmation is refused with "External write actions are not enabled for your organisation."
Live writes to external systems are also governed by settings in Align's deployment environment:
| Variable | Effect |
|---|---|
ASSISTANT_EXTERNAL_WRITES_ENABLED | Must be true for any live external write. Off by default. |
ASSISTANT_EXTERNAL_WRITES_PILOT_ORGS | Comma-separated organisation IDs allowed to make live writes. Unset means every organisation. |
ASSISTANT_EXTERNAL_WRITES_SANDBOX_ONLY | GitHub only. On by default: live writes go only to the repositories listed below. |
ASSISTANT_EXTERNAL_WRITES_SANDBOX_REPOS | GitHub only. Comma-separated owner/repo list allowed while sandbox-only is on. |
See External Writes for what each action does.
Product feedback approvals
Everyone signed in to Align, in any workspace, can send feedback about Align from the Feedback button next to Docs, and client-portal users can send it from the portal header (see Help and Feedback). It all lands in Product Feedback.
Where approved feedback goes
You choose the project once. At the top of the page, Where approved feedback goes reads "Approved feedback becomes an entry in Project · Workspace, in the User Feedback epic." To choose or change it, click Change, pick a project from Destination project, and click Save. Only active and on-hold projects are offered, from every workspace; archived and completed ones are not. The change is recorded in the platform audit log.
Each approved entry is filed in that project's User Feedback epic, where it waits until someone assigns and schedules it. If the project has no epic of that name, the first approval creates it.
Until a project is chosen, the card says so, Approve is unavailable, and feedback waits. If the chosen project is later archived, completed or deleted, the card says which and Approve is unavailable again until you choose another project with Change (or make that project active again). Feedback is never sent somewhere else instead.
Review the queue
The list shows Waiting for review by default; you can also show Approved, Declined or All. Each item shows its kind (Something is broken, An idea or request or Other feedback), the sender's name, email and workspace, when it was sent, the text, and the page and app version it was sent from.
- Approve opens Approve and create an entry. Adjust the Title and Priority (bugs start at High, everything else at Medium) and click Create entry. The entry is created in the chosen project, in its User Feedback epic, with the sender's text and context, as a bug report, feature request or feedback entry, and gets its number then. The item then shows that entry's number.
- Decline opens Decline this feedback. Add a Reason (optional), kept for the record, and click Decline. No entry is created and no number is used.
The sender is not notified either way.
If an approval stopped part-way, the item shows Approval did not finish and a Finish approval button. Finishing links the entry the first attempt made, if it made one, or creates it, in the project that attempt chose even if the destination has changed since. Wait a couple of minutes after the first attempt before finishing it. Two operators approving the same item at once cannot create two entries.
Users and memberships
Open Users (superuser only) for the User Directory across every tenant.
- Find people by name or email, and filter by status, role, platform role, sign-in method (password, SSO, never signed in), inactivity (30, 90 or 180 days) and organisation. Export CSV downloads the filtered list.
- Act on several people by selecting them and choosing Suspend selected, Archive selected, Require password change or Export selected to CSV, then Apply. Bulk actions skip your own account.
Open a person to see five tabs:
| Tab | What you can do |
|---|---|
| Details | Edit the display name, email, account-level role and status, and the Platform Role (Cross-tenant) (None or Superuser). Click Save Changes. |
| Orgs | See every workspace the person belongs to and their role in each. Change the role for one workspace, make a workspace their primary one, remove a membership, or Add one. |
| Projects | The projects they are connected to. |
| Security | Their sign-in method; Reset Password, Require Password Change (at next login), Force Logout (ends every active session) and Impersonate (opens the app acting as this person); and Request Data Deletion under GDPR / Data Deletion. |
| Audit | Recorded actions about this person. |
A person's role can differ between workspaces, so change a workspace role on the Orgs tab. The roles offered there are the ones any workspace can grant; platform_admin is never one of them.
A GDPR Deletion Request suspends the person immediately and records the request in the audit log. The data itself must then be removed by hand, following your GDPR process.
Integrations
The Integrations page has four tabs.
- Provider Catalog lists every integration provider with its category and number of connections. The switch enables or disables a provider for the whole platform: a disabled provider disappears from every workspace, project and personal integration list. Only platform operators can add, edit, enable or disable providers.
- App Credentials holds the credentials of the apps Align registers and runs, such as Align's GitHub App: App ID, Client ID, Client Secret, Webhook Secret and Private Key (PEM). Workspaces never supply these; they only authorise their own accounts.
- Errors lists integration connections that are failing.
- Sentry lists every workspace's Sentry connection with its last check.
Enabling or disabling a provider and registering or rotating app credentials are recorded in the platform audit log.
Email and e-signature settings
Align's email sending and its Dropbox Sign account serve every workspace, so only platform operators can change them. They are in Settings → Integrations, on the Native SMTP, Resend and Dropbox Sign cards. A workspace admin who opens those cards sees a note that Align sets them up for every workspace.
- All Align email, outbound and inbound, uses
send.alignsoft.us. Outbound mail comes fromhello@send.alignsoft.us, and each project's inbound address is<slug>@send.alignsoft.us. - The inbound mail settings are inside the Resend card. Align refuses an inbound domain that the app itself is served from: an MX record on
app.alignsoft.uswould delete the record that points it at the app.
Platform audit log
Audit Log lists privileged platform actions, newest first. Filter by Severity (Info, Warning, High, Critical), event type, actor (ID or email), organisation (ID or name) and date range. Each row shows the time, event type, severity, a summary, the actor and the organisation; expand it for detail. Click Refresh to reload.
Align records:
- tenant provisioning;
- partner application reviews;
- manual revenue snapshots and CSV exports;
- integration providers enabled or disabled, and app credentials registered or rotated;
- every change made in the Users console: profile and role edits, bulk actions, password resets and required password changes, forced logouts, GDPR deletion requests, and memberships added, removed or made primary.
Feature flag changes are not recorded here.