On this page0
Guides
Start here
Step-by-step guides for running your Zonitix instance. The first day and the help pages come first, then the pages every employee and every manager uses, then one group for each job: HR’s groups together, then IT’s, then compliance, finance and the upkeep of the instance. Each guide tells you what you need first, which screen to open, what to click, and what you should see when it worked.
This is the one page that puts the tasks in order. On a new instance, do these five on your first day, in the order shown: sign in, set up backups, check MFA, set up email, add your admins. Backups come second because a new instance stays locked until a first backup has reached storage your company owns and been verified there: after you sign in, only the screens needed to finish open. The three tasks after it are on screens that stay open, so do them while you wait for the storage. Email comes before the admins because the invitations you send them go out by email. Then follow Your first week below. After that, go to the group for the job in hand, or to your card under Start by role.
- First sign-in on a new instance (administrator). Normally done by: you, the person who received the setup email.
- Set up backups. Normally done by: IT, or whoever helps you with IT. With no IT person, start with Hand the technical setup to whoever helps you with IT. Steps 1 to 9 unlock Zonitix; steps 10 to 12 then have 14 days, and need the administrators you add in the last task.
- Check and adjust MFA. Normally done by: you, as the administrator.
- Set up email. Normally done by: you, with four details from whoever looks after your company’s email (Hand the technical setup to whoever helps you with IT lists them).
- Add your admins. Normally done by: you, as the administrator.
An instance that was already in use when backups became a requirement is not locked on the day: it shows a banner with a date 30 days ahead instead. Set up backups covers both cases. How updates get installed was chosen on the wizard’s Updates step during the first sign-in; Apply updates shows how to check or change it.
Stuck? Open When something goes wrong. Met a word you do not know? It is in Glossary: words used in these docs, by letter: A B C D E F G H I J K L M O P Q R S T U V W Z . Need a person? See Contact Zonitix support.
Inside the app, press Cmd+K on a Mac or Ctrl+K elsewhere, or click the search box in the top bar, to search pages, actions and people and jump straight there. New to the screen? See Find your way around Zonitix.
Reviewing Zonitix for security, or writing code against it? Skip the guides and go to the Reference Overview, which says what each technical section answers and gives a reading order; there is more under For developers at the foot of this page.
Your first week
After the first day, work through the setup card. Administrators see it on the dashboard, which opens once the first backup is verified, titled Get Zonitix set up: it lists the seven steps below, and Zonitix ticks each one by itself when it is done. The guide for each step, in the card’s order, with who normally does it:
- Connect your directory: Connect Okta, Entra or Google. Normally done by: IT, or whoever helps you with IT. Skip it if your company has no directory or identity provider.
- Set up single sign-on: Turn on single sign-on. Normally done by: IT, or whoever helps you with IT. Skip it if your company has no directory or identity provider.
- Add your team: Add users. Normally done by: an administrator or HR.
- Enroll a device: Enroll a device. Normally done by: IT, or whoever helps you with IT. If you do not look after your company’s computers yourself, do it together with the person who does.
- Run your first onboarding: Onboard your first hire. Normally done by: HR, with IT for the accounts and the computer.
- Configure off-box backups: Set up backups. Normally done by: IT, or whoever helps you with IT. With no IT person, start with Hand the technical setup to whoever helps you with IT. On a new instance you began this on your first day, because Zonitix stays locked until the first backup is verified; what is left is to share out both recovery keys, within 14 days of that backup.
- Configure email (SMTP): Set up email. Normally done by: you, with four details from whoever looks after your company’s email (Hand the technical setup to whoever helps you with IT lists them). Already done if you followed Your first day.
If your company has no directory or identity provider, leave the first two steps: people then sign in with a Zonitix password. You can hide the card with its cross at any time. A guide labelled IT administrator says under Before you start what it assumes and who to do it with.
Start by role
Open the card that describes you. Each one lists the pages for that job, in the order of the groups further down.
Administrator
21 guidesYou are setting Zonitix up and keeping it healthy.- First sign-in on a new instance (administrator)
- Check and adjust MFA
- Set up email
- Add your admins
- When something goes wrong
- If you think an account or a computer has been compromised
- Contact Zonitix support
- Change, disable or delete a user
- When your main administrator leaves
- Hand the technical setup to whoever helps you with IT
- Set up backups
- Be a trustee for a backup key
- Restore from a backup
- Apply updates
- Check system health
- Read your license and plan screen
- Your Zonitix account on this website
- Custom fields and managed lists
- Brand your instance
- Which emails Zonitix sends, and how to stop or change one
- Give Zonitix support temporary access
HR: people and records
13 guidesYou keep each person’s file, time off, goals and reviews.- Add users
- Change, disable or delete a user
- Departments and naming
- Use the org chart
- Open and maintain an employee file
- Record that someone is leaving
- Choose where people data lives (HR Settings)
- Set up time off
- Set goals
- Run a review cycle
- Run an anonymous survey
- Hand off to payroll
- Read the People Reports
HR: hiring, joiners and leavers
12 guidesYou hire people, get them started and see them out.- Create a persona
- Read the price lists behind persona costs
- Hire someone
- Pause, close, reopen or delete a job
- Write an offer letter template
- Prepare interview questions
- Run an interview and submit your scorecard
- Onboard your first hire
- Offboard someone
- Work through workflow tasks
- Customize a workflow
- Record that someone is leaving
HR: training and policies
5 guidesYou assign courses and get policies signed.IT: sign-in and access
13 guidesYou control who can sign in and what they can reach.- Check and adjust MFA
- Roles, groups and permissions
- Turn on single sign-on
- Password policy and sessions
- Help someone who is locked out
- When your main administrator leaves
- Connect Okta, Entra or Google
- Connect an app (Slack, GitHub, Zoom and others)
- Push users with SCIM
- Fix directory drift with AlignSync
- Handle access requests
- Find the apps your company uses
- Create an API token
IT: computers
7 guidesYou look after the computers people work on.Security
10 guidesYou watch for threats and test your own systems.- If you think an account or a computer has been compromised
- Run a phishing simulation
- Block countries and IP addresses
- See who did what (the audit log)
- Forward logs to your SIEM
- Turn AI on or off and choose the model
- Run a Security Lab scan
- Send Security Lab findings to Jira or ServiceNow
- Connect AWS, Azure or GCP
- Act on an identity risk in your cloud account
Compliance and audit
10 guidesYou prepare for an audit and answer data requests.- See who did what (the audit log)
- Get started with the Compliance Hub
- Do your compliance tasks
- Keep policies up to date and download the Statement of Applicability (SoA)
- Keep your risk register and vendor register
- Publish your Trust Center page
- Run, save and share a report
- Run an access review
- Export all your company data
- Handle a personal-data request
Finance
7 guidesYou approve and pay bills, hold budgets and close the month.Manager
7 guidesPeople report to you, and some requests wait for your decision.Employee
15 guidesYou use Zonitix for your own work and your own account.- Find your way around Zonitix
- Sign in for the first time (employee)
- Your to-do list
- Your profile and sign-in security
- See and edit your own details
- Request time off
- Do a training course you were given
- Sign a policy
- Complete a performance review
- Answer a staff survey
- Submit a bill
- Install the Zonitix Agent on your Mac
- Refer someone for a job
- Set goals
- Handle access requests
Security reviewer or developer
7 pagesYou are assessing Zonitix, or building against its API.
Your first day
- First sign-in on a new instance (administrator)Sign in to your new instance, choose how updates are installed, secure the primary admin account, and see why backups come next.
- Check and adjust MFACheck who must use a second factor, and require or exempt chosen groups.
- Set up emailConnect your mail server so invites, sign-in links and offers get delivered.
- Add your adminsInvite the people who will run Zonitix and give them the right roles.
Getting help
- Find your way around ZonitixWhat is on the screen after you sign in: the left menu, the search box, the notification bell, the dashboard, your profile and sign-out.
- When something goes wrongStart from what you see on screen, find out what it means, and go to the guide that fixes it.
- If you think an account or a computer has been compromisedShut the door first, then find out what happened: block the account, cut its sign-ins and tokens, lock the computer, and read what the account did.
- Contact Zonitix supportWhere to write to us, what to include so we can help the first time, and how to report a security issue.
- Glossary: words used in these docsPlain definitions of the terms the guides, the reference pages and the app use, from SSO and SCIM to pipeline, control, cost centre, endpoint and session token.
For every employee
- Sign in for the first time (employee)For every employee: open your invitation, choose a password, add a second proof if your company asks for one, and reach your dashboard.
- Your to-do listFor every employee: find the training you have to do and the policies you have to sign, in one list.
- Your profile and sign-in securityFor every employee: manage your passkeys, recovery codes and trusted devices, get your password changed, and download your personal data.
- See and edit your own detailsFor every employee: read what your employee file says about you, keep your phone number, personal email, home address and emergency contacts up to date, and know which details only HR can change.
- Request time offFor every employee: see how many days you have, ask for time off, follow the answer, and cancel if plans change.
- Do a training course you were givenFor every employee: open an assigned course, work through it, pass the questions, and get your certificate.
- Sign a policyFor every employee: read a policy you were asked to sign, confirm it, sign with your name, and keep a copy.
- Complete a performance reviewFor every employee: write your self review, give feedback if asked, and read your review when it is shared. For managers: write and share your team’s.
- Answer a staff surveyFor every employee: answer a survey your company opened, and know what is and is not recorded about you.
- Submit a billFor anyone asked to send in a bill: upload it from your own menu, check what Zonitix read, and follow it until it is paid.
- Install the Zonitix Agent on your MacFor every employee: you got an email asking you to install the agent. Download it, install it and check that it is running.
- Refer someone for a jobFor every employee: put forward someone you know for an open role and follow how far they get.
For managers and approvers
- See your team as a managerFor managers: who reports to you, what training and policies each person has open, and the job details you may see.
- Approve your team’s time offFor managers: find the requests waiting for you, see who else is away, and approve or decline each one.
- Find what is waiting for your approvalFor managers and approvers: which screen each kind of request lands on, from time off to access, offers and bills.
People
- Add usersAdd people one at a time or from a CSV, manage invitations, and see how directory users differ.
- Change, disable or delete a userWhat every button on a person’s row in Users does: edit their details, block or unblock their sign-in, set a password, delete an account, and change several people at once.
- Departments and namingKeep one clean list of departments, and set how usernames and work email addresses are built for new people.
- Use the org chartSee who reports to whom, move someone under a new manager, add dotted-line managers, and compare dated snapshots.
- Create a personaDefine what a role gets on day one: apps, licences and hardware.
- Read the price lists behind persona costsFind the reference software prices and hardware models that persona cost estimates are worked out from, and know their limits.
Hiring
- Hire someoneTake a role from approved job posting through interviews and an approved offer to a signed hire.
- Pause, close, reopen or delete a jobAfter a job is posted: take it off your careers page, put hiring on hold, close it, bring it back or delete it, and what each does to the candidates.
- Write an offer letter templateWrite an offer letter once, copy one you already have or let the AI draft it, add the documents that go with it, and choose it when you send an offer.
- Prepare interview questionsFor HR: write the set of questions every interviewer for a role will ask and score, so candidates are judged against the same list.
- Run an interview and submit your scorecardFor interviewers: find the interview, use the prepared questions, rate the answers and send your recommendation.
Joiners and leavers
- Onboard your first hireStart a new person’s onboarding and work their accounts, apps and devices through to day one.
- Offboard someoneBlock a leaver’s sign-in, revoke their access and track what still needs returning.
- Work through workflow tasksFind the runs waiting on you, claim a step, tick the checklist, approve, and check History.
- Customize a workflowAdd, reorder or skip steps, set the automation mode, and get a second approver to put it live.
HR records, time off and reviews
- Open and maintain an employee fileFind a person’s file, edit details, record job changes, add documents, and know who can see each part.
- Record that someone is leavingPut a planned exit on a person’s employee file, record why they are leaving, and work through HR’s exit checklist.
- Choose where people data lives (HR Settings)Say whether HR edits job details here or in another HR system, which fields that system owns, and how long a leaver’s HR record is kept.
- Set up time offDefine leave types and working calendars, then take a first request through a manager’s approval.
- Set goalsAdd goals for yourself or your reports, track progress, and keep example goals people can start from.
- Run a review cycleCreate and launch a review cycle, calibrate and release ratings, and get each review shared.
- Run an anonymous surveyWrite a staff survey, open it, and read the combined results once enough people have answered.
- Hand off to payrollBuild one CSV for a pay period: joiners, leavers, pay changes and approved time off.
- Read the People ReportsHeadcount, joiners, leavers, turnover and tenure for a period, as counts only, with a CSV download.
Training and policies
- Set up trainingAdd a course from the library or write your own, assign it with a due date, and see who has done it.
- Build a learning pathPut courses in order so each person gets the next one when they finish the last.
- Import training done elsewhere, or a SCORM lessonBring in completions from another training system, for one course or many, and add a SCORM lesson to a course.
- Get policies signedAdd a policy from the template library, approve it, and track who has and has not signed.
- Run a phishing simulationPrepare a practice phishing email for your own staff, get it approved, send it, and read the results.
Sign-in, access and directories
- Roles, groups and permissionsWhat roles, groups and permissions do, the built-in set, custom roles, group MFA and one-off grants.
- Turn on single sign-onConnect Okta, Entra or Google over OIDC or SAML so people sign in with one account.
- Password policy and sessionsSet password strength and reuse rules and how long a sign-in lasts, and what changing them does.
- Block countries and IP addressesBlock countries and IPs, ban password guessers, and avoid locking yourself out.
- Help someone who is locked outGet a person back in: a locked account, a forgotten password, a lost phone or passkey, or a disabled account.
- When your main administrator leavesThe primary administrator account cannot be removed or given to another name. Hand over its password, second factor, recovery codes and mailbox instead.
- Connect Okta, Entra or GoogleLink your identity provider so people sync in and access can be granted and removed.
- Connect an app (Slack, GitHub, Zoom and others)Link one of your company’s apps so Zonitix can list who has an account there and, where the app allows it, create and remove accounts.
- Push users with SCIMLet Okta or Entra create, update and offboard people in Zonitix as changes happen.
- Fix directory drift with AlignSyncScan for people whose details disagree across your directories, preview and apply corrections, and roll a change back.
- Handle access requestsLet staff ask for apps: an approver decides, then IT provisions it, with every decision logged.
- Find the apps your company usesSee every app your people sign in to through Okta or Google, who uses each one, and which accounts are dormant or unmatched.
Security
- See who did what (the audit log)Find out who signed in, who changed a permission or a setting, and when, by reading and filtering the record Zonitix keeps of every action.
- Forward logs to your SIEMStream your audit log to Splunk, Datadog, syslog or a webhook.
- Turn AI on or off and choose the modelSwitch the AI helpers off for everyone, limit them to chosen people, or change which AI model answers.
- Run a Security Lab scanAuthorise and verify your hosts, run a scan, triage findings, and re-test until they clear.
- Send Security Lab findings to Jira or ServiceNowHave a ticket opened for each new Critical or High finding, and closed when a re-scan shows it is fixed.
- Connect AWS, Azure or GCPGive Zonitix read-only access to your cloud and read the resource map.
- Act on an identity risk in your cloud accountRead the risky cloud users and access keys on a resource map, try the AWS fix Zonitix offers, and know when to fix it in the cloud account.
Devices
- Enroll a deviceInstall the Zonitix Agent on a Mac, Windows or Linux machine.
- Enroll a Mac in Apple MDMConnect Apple MDM, install your Apple push certificate, and get a Mac to install the enrollment profile.
- Manage a device day to dayFind a machine, read its tabs, send lock, restart or update commands, retire or return it, and roll the agent back.
- Get the recovery key for a locked diskRead the FileVault or BitLocker recovery key Zonitix holds for a computer, and have a FileVault key replaced afterwards.
- Group devicesPut machines into static or smart groups so a profile or agent update reaches only those machines.
- See what software is installedList the applications your company’s computers report, see the versions in use, find the machines that have one, and download the list.
- Push a compliance profileTurn on the firewall and other security settings on devices, then see which devices prove it.
Compliance and reports
- Get started with the Compliance HubPick a framework, collect and review evidence, track readiness, and export a package for your auditor.
- Do your compliance tasksFor control owners: see what proof is needed, attach it, send it for review, and deal with anything sent back.
- Keep policies up to date and download the Statement of Applicability (SoA)See which written policies are approved, waiting or due for another look, get them approved again, and download the Statement of Applicability.
- Keep your risk register and vendor registerWrite down the risks your company faces and the outside companies it relies on, give each an owner and a score, and record a security review of each vendor.
- Publish your Trust Center pagePut up one public page that tells your own customers how your company looks after their data, choose what it shows, and take it down again.
- Run, save and share a reportRun a report in the Report Engine, export it, save it, schedule it, and share a sealed copy from the evidence vault.
- Run an access reviewLaunch a certification campaign, have reviewers keep or revoke access, and export the evidence.
- Export all your company dataDownload one ZIP of your users, workflows, audit log, evidence, candidates, signed documents and devices.
- Handle a personal-data requestGive an employee, former employee or candidate a copy of their data, or erase it, and read what the result means.
Finance
- Capture and approve a billUpload a bill, check what Zonitix read, and take it through approval to paid.
- Import bills and export the ledgerBring bills in from a CSV file, submit, approve or reject many at once, and download the ledger or the finance audit trail for an auditor.
- Match bills to purchase ordersRecord a purchase order and what was delivered, and fix or waive a bill that does not agree with it.
- Tidy your vendor listGive each company you pay a category and an owner, list the other names it bills under, and merge duplicates.
- Set up and approve a budgetCreate a department budget, get it approved as the baseline, and hold budget with spend requests.
- Close the monthCheck a month’s bills are finished, lock the month, export the journals, and correct it later with an adjusting entry.
- Track what you spend on softwareSee what each subscription costs, who owns it, when it renews, whether it is over budget, and what idle accounts cost.
Running your instance
- Hand the technical setup to whoever helps you with ITFor a company with no IT person: what to ask your IT helper to do for backups, email and updates, what to give them, and how to know each one is done. Start here on day one: a new instance is locked until its first backup.
- Set up backupsSend encrypted backups to an S3-compatible bucket or an Azure Blob Storage container that you own, and check they run. A new instance stays locked until the first one is verified.
- Be a trustee for a backup keyFor a person asked to hold one part of a backup key: make your key file, send back the part that is safe to share, keep the kit, and take part in one test.
- Restore from a backupRoll the database back to an earlier restore point and put stored files back, with a second admin approving.
- Apply updatesLet Zonitix install its own releases and server patches in a weekly maintenance window, or apply them yourself, with a backup first either way.
- Check system healthSee server load, which services are running, your version and the last backup.
- Read your license and plan screenSee your plan, which features are on, whether the instance is in touch with Zonitix, and what people see when a feature is not in the plan.
- Your Zonitix account on this websiteFind your plan, invoices and payments, documents and account security in the customer console, and know how it differs from signing in to your instance.
- Custom fields and managed listsAdd your own fields to vendors, devices and access requests, and curate job titles, locations and other lists.
- Brand your instancePut your name, logo and colour on sign-in, the app and emails, and set time zone and date format.
- Which emails Zonitix sends, and how to stop or change oneWhat the emails from your instance are, who each kind goes to, and the screen where you change who receives one or how it looks.
- Create an API tokenCreate a scoped, expiring personal API token for a script, copy it once, and revoke it when done.
- Give Zonitix support temporary accessGrant Zonitix support time-boxed, audited access, revoke it anytime, and share a diagnostics bundle.
For developers
Most guides need no technical background; the ones that do carry an IT administrator label and say in their first line who to hand them to. If you are writing a script or connecting another system to Zonitix, start at the API reference. How each part works underneath is in the reference sections further down the sidebar; the Reference Overview maps them.
Your instance also serves an OpenAPI 3.1 description of part of its API, a saved file shipped with the release it runs, at https://<your-instance>.zonitix.com/api/docs. The page is public and carries none of your data; each endpoint it lists still enforces its own authentication.