Admin guide

Users and roles

Three roles inside a workspace: tenant_admin (full control, billing, users, settings), tenant_user (chat, memos, library), and tenant_viewer (read-only). The signup user becomes the first admin. Invite the rest from Settings → Users.

Roles are RLS-enforced. A tenant_viewer cannot reach a write endpoint even if they crafted the request manually — the database itself rejects.

Subscription lifecycle

New workspaces start in trial (14 days, full Starter features). At the end of trial, if no payment, the workspace flips to grace (7 days, read-only warning shown). After grace, readonly (7 days, all writes refused). After readonly, suspended (sign-in still works; data preserved). At day 120,purged (irreversible erasure — see Account closure below).

Upgrades are prorated; downgrades take effect at the next billing date. Cancellation by the tenant moves through the same flow but with a 30-day grace before purge.

Quotas

Every plan has per-resource quotas: messages, conversations, memos, monthly tokens, agents, products, users. Track utilisation under Settings → Subscription.

A soft-cap warning fires at 80%; a hard-stop fires at 100%. The hard-stop flips the workspace to read-only for the over-quota resource until the next billing window. The token cap also applies daily to prevent runaway model spend.

Billing — INR vs USD

India and Nepal workspaces pay in INR via Razorpay; everywhere else pays in USD via Stripe. Indian invoices apply 18% GST (IGST 18% for inter-state, or CGST 9% + SGST 9% for intra-state, based on the state code on your GSTIN). ROW invoices are zero-rated export from India — no Cortex-applied tax.

Invoices land under Settings → Invoices. Download as PDF, or wait for the emailed receipt.

API keys

Generate a workspace-scoped Cortex API key from Settings → API keys. The secret is shown once at creation — copy it immediately. Authenticate with Authorization: Bearer ck_… and revoke a key instantly from the same screen. Per-plan rate limits apply.

BYO Anthropic key

On Flex (or with a special arrangement on Enterprise) you can bring your own Anthropic API key. Paste it under Settings → BYO Anthropic. Cortex encrypts at rest with AES-256-GCM and uses your key for all model calls from that workspace. Token caps still apply — they bound your spend, not Cortex’s.

Audit log

Settings → Audit log shows every user action, model call, subscription event, and admin event for the workspace. The log is append-only at the database level — no admin can edit or delete a row, including via the DB directly. Export the log as JSON for compliance archival.

DSAR self-service

Under Settings → Account, any tenant_admin can download a full DSAR export covering all 13 personal-data categories Cortex holds. The bundle is delivered as a single ZIP with a markdown index. GDPR + DPDP both honour this within 30 days; Cortex delivers it inline.

Account closure

Closing the workspace starts a 30-day grace, during which you (and only you) can reopen it with one click. After day 30, the erasure cascade runs and the data is unrecoverable: messages, conversations, memos, library, agent definitions, users (deactivated), then the subscription + tenant flip to purged. The audit log retains a stub for regulatory record-keeping.