Roles
Store managers who can look, not edit
Managers get the Viewer role. They read the sales dashboard and use a seat, like everyone in the workspace.
Field entry 10 · Teams & securityOwner · Admin · Editor · Viewer
Built for teams. Ready for IT.
Work together in real time, keep every version, decide who can see what, and keep a record of who signed in and who saved each version. The same care goes into the apps you publish.
1,000 free tokens to try · Unlimited app users · Our cloud or your own servers
We open in waves. Join early access and we'll email you when your workspace is ready.
People
Dev
People5 of 100 seatsAdd person
PersonRoleSeat
JLJo Leejo@fernleaf.appOwnerYes
AKAisha Khanaisha@fernleaf.appAdminYes
RSRavi Shahravi@fernleaf.appEditorYes
SOSam Okaforsam@fernleaf.appViewerYes
LFLena Foxlena@fernleaf.appViewerYes
People who use your published appsNot seats
Add a person
lena@fernleaf.app
AdminEditorViewer
Devv14Saved · in review
Bring to Prod
Prodv13v14Protected stage
v14Saved by Ravi ShahDev
v13PublishedProd
v12SavedRestore
v11SavedRestore
Compare v14 with v13
+Bar chart on Sales overview
~Button label on Product page
+Returns page
Reviewed by Aisha Khan
v14 is now in Prod
Audit logAllSuccessFailureExport
WhenWhoWhat
Maya ChenLogin succeeded
Theo ParkLogin failed
Lena FoxSign up
Maya ChenMFA verified
Sam OkaforPassword changed
Ravi ShahAPI key created
Audit log export ready
01What teams set upThree Fernleaf examples
The answers IT asks for, already there.
Who can build, who can only look, what changed and when. Fernleaf set these up once, and now they just work.
Stages
A storefront that changes only on purpose
Work happens in Dev. Changes are compared, reviewed and brought to a protected Prod stage.
Access
Each manager sees their own region
A row rule shows each manager only their region, and customer emails are masked.
02How it worksSeven entries · Fig. 2 to 8
Work together, safely.
From the people who build to the people who visit your apps, every part has its own lock, and the log keeps the story.
01build together
Entry 01
Build together Team and Enterprise
See who is working where, and edit the same page at the same time. On workflows, leave a comment right on the block it is about.
- Live cursors and co-editing on Team and Enterprise
- Comments on workflows
- Everyone sees the same page, as it changes
Ravi is editing
Ask a manager to approveHuman Approval2
AKShould this escalate after 4 hours?
RSYes, to the Ops lead.
Fig. 2. Two people on one page, and a comment thread on a workflow block.
02versions and stages
Entry 02
Versions and stages
Save a version whenever you like. Compare two versions, review them, and restore an old one if you need it.
- Save, compare, review and restore
- More stages per app on Team and Enterprise, such as Dev and Prod
- Bring changes between stages
- Protect a stage
Dev
Prod
v13Published
v14 is in Dev. Prod is protected.
Fig. 3. Try it: bring v14 to Prod, or switch the stage lock.
03four roles, one seat each
Entry 03
Four roles, one seat each
Owner, Admin, Editor and Viewer. Everyone in the workspace uses a seat, Viewers too. People who use the apps you publish are not seats.
- Owner, Admin, Editor, Viewer
- Everyone in the workspace is a seat
- People who use your published apps are not seats
4seatsworkspace members
0app visitorsnot seats
Add a person and watch the seat count.
Fig. 4. Add a Viewer and the seat count goes up. Add an app visitor and it does not.
04company sign-in
Entry 04
Company sign-in Enterprise
On Enterprise, your team signs in to the workspace with your company account through SSO, and SCIM keeps the member list in step with your company directory.
- SSO for the workspace
- SCIM for the member list
- On the Enterprise plan
Sign in to Fernleaf Supply
Continue with SSO Single sign-on · SSODirectory syncSCIM
Company directoryFernleaf workspace
Member list in step
Fig. 5. Company sign-in for the workspace, with the member list kept in step.
05365 days of audit log, at most
Entry 05
Audit log
Sign-ins, sign-ups, password changes, multi-factor steps and API keys for your apps are written down with who and when. How long the log is kept depends on your plan, and Enterprise can export it.
- 7 days on Starter
- 90 days on Team
- 365 days on Enterprise, with export
today90 days365 days
365 days kept
Export the logFig. 6. Pick a plan to see how long the log is kept, and where export comes in.
06security for your apps
Entry 06
Security for your apps
The apps you publish get the same care. Pick how visitors sign in, add a second step, and keep bots and attacks out.
- Multi-factor and app roles on Team and Enterprise
- Attack protection and bot checks on every plan
- More sign-in methods on Team, and company sign-in methods on Enterprise
- API clients with keys
Sign in to fernleaf.app
Email and passwordMagic linkGoogleMicrosoftAzure ADGitHubGitLabAppleAny OpenID Connect providerLDAP or Active DirectoryPhone code
Enter the code we sent you
Multi-factor is on for this app
Bot checksAttack protectionApp roles
Fig. 7. The sign-in methods a visitor can use on fernleaf.app, and the second step.
07data access
Entry 07
Data access
Row rules decide which rows a person sees. Column masking hides the parts they should not read. Preview as any person to check it before they do.
- Row rules
- Column masking
- Preview as any person
Preview as
| Order | Customer email | Region |
|---|---|---|
| #10482 | maya.chen@gmail.com | West |
| #10481 | theo.park@gmail.com | Central |
| #10479 | sam.okafor@gmail.com | West |
| #10478 | nina.ross@gmail.com | South |
| #10477 | lena.fox@gmail.com | West |
All rows, nothing masked.
Fig. 8. The same orders table, previewed as two people.
Where it runs
Our cloud, or your own servers.
Every plan runs either way. On your own servers or private cloud, your app and your data stay with you.
03Works withThe same rules under every builder
One set of rules, every builder.
The same people and roles work across the whole workspace, and the same sign-in and access rules protect the apps you publish.
- Web appsVisitor sign-in, app roles and access rules.
- Data & connectorsRow rules, column masking and preview as any person.
- WorkflowsComments on blocks, and API clients with keys.
- Our cloud or your serversKeep your app and your data on your own servers.
Visitor sign-in with
- Microsoft
- Azure AD
- GitHub
- GitLab
- Apple
- OpenID Connect
- LDAP
- Active Directory
- and more
Google on every plan. Team adds the rest up to OpenID Connect. Enterprise adds LDAP and Active Directory. The list grows with every release.
Browse all integrations04Plan notesWhat changes by plan
Locks on every plan, more on bigger ones.
Roles, saved versions and the audit log come with every plan. Team adds live co-editing, version compare and stage merges. Enterprise adds company sign-in and audit export.
See pricing| Feature | Starter | Team | Enterprise |
|---|---|---|---|
| Roles, saved versions, audit log | Yes | Yes | Yes |
| Compare versions, bring changes between stages | No | Yes | Yes |
| Visitor multi-factor, app roles and access rules | No | Yes | Yes |
| Live co-editing | No | Yes | Yes |
| Stages per app | 1 | Unlimited | Unlimited |
| Audit log kept | 7 days | 90 days | 365 days |
| Audit log export | No | No | Yes |
| Company SSO and SCIM | No | No | Yes |
| People who use your published apps | Unlimited | Unlimited | Unlimited |
05Questions
Fair questions.
Everyone in your workspace, Viewers too. People who use the apps you publish do not, and they are unlimited on every plan.
Four: Owner, Admin, Editor and Viewer.
Yes, on Enterprise. Company SSO and SCIM come with the Enterprise plan.
7 days on Starter, 90 days on Team and 365 days on Enterprise. Enterprise can also export it.
Yes. Preview as any person to see their rows and masked columns before they do.
Where to begin
Bring your team in.
Invite your team, pick their roles, and keep a record of every change. At launch, you can try it with 1,000 free tokens for 14 days.
We open in waves. Join early access and we'll email you when your workspace is ready.