Klytic

Home›Guides›Documents & document management

Documents & document management · Use Klytic Docs

Controlling who sees which documents

In Klytic Docs, access is set at two levels: the account, which lets a person into your instance, and the folder, which defines what they can do there. Rights are best granted to groups and team folders, by an administrator of your instance, rather than file by file.

Updated October 20266 minHow-to Klytic Docs

What you get

Each employee sees three things: their personal space, the team folders open to their groups, and items a colleague has shared with them. Nothing else. Rights are set per user, per group and per folder, in an instance dedicated to your company.

The right setup fits in one sentence: one team folder per stable scope (department, site, company), one group per population, and individual shares kept for one-off cases.

Two levels: the account and the folder

The account decides who gets in. It is created, deactivated or deleted by an administrator of your instance. Two-factor authentication is available to strengthen sign-in.

The folder decides what the person can do once inside. Three levels are enough in most cases:

RightWhat it allowsExample
ReadOpen and viewQuality procedures for all staff
EditCreate, edit, delete filesSales department working folder
ReshareGive access to other people in turnProject lead bringing in colleagues

The reshare right is the most sensitive: it is what takes a document outside its intended scope. Grant it only to those who need it.

Think in groups, not names

As soon as the team exceeds a few people, grant rights to groups: “Accounting”, “Lyon Workshop”, “Management”. A group is maintained in a single step:

  • a new hire: the person is added to the group and immediately sees their department’s folders;
  • a role change: they change group, and their access follows;
  • leaving a team: they leave the group, and access disappears without touching the folders.

Rights granted name by name always end up drifting away from the real organization. Nobody remembers why a former intern can still see the quotes folder.

The team folder: a department, a site, a company

A team folder belongs to the organization, not to a person. An administrator creates it, links one or more groups to it and sets each group’s level of rights. Files placed in it stay put when their author changes role or leaves the company.

For more sensitive content within a department, for example payroll within human resources, the simplest option is a separate team folder, open to a smaller group. Finer-grained rights on a subfolder can also be set when this option is enabled on your instance: ask Klytic support.

Company or subsidiary: within a single instance, the lever is the same, one group and team folders per company. If the companies must be isolated to the point that no shared administrator can see the other, that is a different architecture, described in Several companies in Klytic Docs. The case of a person working for two subsidiaries is also covered there.

Who administers what

  • Your instance administrator, a person from your organization: they create accounts and groups, open team folders, and set sharing rules for everyone.
  • A group administrator, if you delegate: they manage the accounts in their group (creation, password, quota), without access to the general settings. Useful for a site or subsidiary that handles its own new hires.
  • Each user: they share their own files, within the limits set by the administrator.
  • Klytic support: helps you set up this organization, handles maintenance and restorations, included or charged depending on the cause (see Recovering a version of a document). Klytic technicians only intervene for the needs of the service, with a logged trail. They do not decide on your behalf who sees what.

Checking who has access to a file

The details panel of a file or folder shows who it is shared with. It also shows the people who have access because a parent folder was shared with them. This information is visible to the owner and to people with the reshare right. It is the first check to make before placing a sensitive document in an existing folder.

Reviewing access: the log

Klytic Docs keeps a log of access and folder activity: creations, edits, deletions, shares. It lets you answer questions such as “who shared this folder?” or “who deleted this file, and when?”. Access and administration logs can also be exported to your own monitoring tools.

If you need a finer trail, for example simply viewing a specific file, check with Klytic support what your instance records before making it an internal rule.

Example: a 40-person SME

Team folderGroup with edit rightsGroup with read rights
SalesSalespeopleManagement
AccountingAccountingManagement
HRHRnone
ProceduresQualityAll staff

The reshare right is granted only to department heads. A new salesperson is added to the “Salespeople” group: there is nothing else to do.

Limitations

Limiting write rights also reduces what a compromised account can encrypt or erase. The full reasoning is in the guide Protecting a document management system against ransomware, and restoring it.

Frequently asked questions

An employee is leaving the company: what should I do with their access?

Remove them from their groups, recover their personal files, then deactivate their account. The procedure is in Documents when an employee or a team leaves.

Can I prevent a group from sharing externally?

Yes, the administrator can exclude certain groups from creating shares. See Sharing links, partners and uploads.

Should two subsidiaries have two instances?

Only if no shared administrator may see the other company. The two setups are compared in Several companies in Klytic Docs.

A file was deleted by mistake: who can recover it?

The user, from the recycle bin, free of charge. If the recycle bin is no longer enough, Klytic support restores from the backups of the last 30 days. A deletion by mistake is a handling error: this restoration is handled through a paid support ticket. See Recovering a version of a document.

Need help setting up your groups?

Klytic support helps you translate your organization into groups and team folders.

Contact support →

Set up sharing links

Further reading

Use · Documents & document managementSharing links, partners and uploadsShare internally, send a protected link outside, work with a partner and avoid accidental sharing in Klytic Docs.7 min readRead →Use · Documents & document managementDocuments when an employee or a team leavesRemove a group, recover personal files, close links and shut down the account: an employee's departure in Klytic Docs, without losing anything.6 min readRead →Use · Documents & document managementSeveral companies in Klytic DocsOne instance per company or separate scopes within a single one: how to isolate each entity's documents, and the case of one person in two subsidiaries.6 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing