On this page0
Guide
Give Zonitix support temporary access
Let Zonitix support look into a problem on your instance for a set number of hours, see everything they do, and end it whenever you want.
Before you start
- Only an administrator can grant or revoke access. Others who can open Security Settings see the status but not the buttons.
- The email address Zonitix support gave you. Zonitix has no built-in address; the sign-in invitation only goes where you send it.
- That address must not belong to anyone already in your directory.
- Email set up in Zonitix, so the invitation can be sent. If it is not, you get a one-time link to pass on yourself.
What Zonitix can reach without this grant
This grant is about the app. The server underneath it is a separate matter, because we host it:
- We hold one SSH deploy key with full (root) access to your server. That is a key that lets our deployment tooling log in to the server itself, not to your app. It is used to set the server up and, at the end, to tear it down. We do not use it to access your instance or your data unless you ask us to in writing (see Terms §5).
- We hold the account at the hosting provider that your server runs on. Through that account we can reach the provider’s own control panel for the server, start it in the provider’s repair mode (the provider calls it rescue mode) and take or restore whole-disk copies (snapshots), without that key. Our deployment tooling does not use them.
Grant access
Step 1: Open Support
Go to Security & ComplianceSecurity SettingsSupport. It is the last item in the Security Settings menu. The “Support access” card shows “OFF”.
Optional: enter the address once under “Support mailbox” and click “Save”, so it is filled in for you next time.
Step 2: Choose how long
Click “GRANT SUPPORT ACCESS”. Under “How long”, pick 1, 4, 8, 24, 48 or 72 hours, or type a whole number of “Hours” from 1 to 72. Access ends on its own at the end of the window.
Step 3: Choose what support can do
“Read-only diagnostics (recommended)”: support can look but every change is refused. They can see the dashboard, system health and updates, the audit log, users, groups, roles, devices and reports. They are not given HR, finance or recruitment records.
“Act with a role”: support can make the changes that role allows. Choosing the administrator role gives full control of your instance, so you must tick “I understand and want to give support administrator access for this window.” Only do that if support asks for it for a specific fix.
Step 4: Address and reason
Enter the “Support e-mail address” and a “Reason / ticket reference” (at least 5 characters). The reason is recorded in the audit log and in the email described in step 6.
Click “Grant access” and confirm it is you: a window titled “Sudo Mode Required” asks for your password or passkey again (what Sudo Mode is).
Step 5: Support signs in
Support receives a single-use link to set a password, and must set up MFA before they can sign in. Each grant starts with fresh credentials; nothing from an earlier grant still works.
While access is on
Step 6: You can see it everywhere
Every administrator, and anyone else who can manage Security Settings, sees a banner across the app saying support has access and until when, with a “Review or revoke” button. Everyone who can manage Security Settings is emailed when access is granted, revoked or expires.
The card shows “ACTIVE”, who granted it, the reason, and whether support has accepted the invitation and set up MFA.
Step 7: See what support looked at
Everything support opens and every change they make is written to the audit log (repeat views of the same page within 30 seconds count once), including anything refused because the grant is read-only. In SystemSystem Logs, type the support address into the “User” filter.
Diagnostics bundle
Step 8: Download it and read it
On the same page, click “GENERATE DIAGNOSTICS BUNDLE” and confirm it is you. A file named “zonitix-diagnostics-….json” is saved to your computer. Nothing is sent anywhere; you decide whether to attach it to your ticket. Each download is recorded in the audit log.
It contains: the installed version, the health of each part of Zonitix, license status, a database structure check, counts of stuck or failed workflow runs and access requests, error events from the audit log (up to 50 from the last 7 days), your settings, and a summary of support access.
Before it is saved, passwords, keys, tokens, certificates, email addresses and IPv4 addresses are replaced with “[REDACTED…]” markers, and long setting values are left out. Other text is kept as recorded, so error messages and settings may still mention names, such as a person, app or your domain. Read the file before you send it.
End access
Step 9: Revoke early, or let it expire
Click “REVOKE NOW”, then “Revoke access”. Support is signed out at once, and their password, passkeys and trusted devices are wiped; the authenticator is reset when the next grant is made. At the end of the window the same happens on its own. The grant then moves to “Past grants”.
To give more time, revoke and grant again. Support then gets a new invitation.
What you should see
While a grant is live, the card reads “ACTIVE” with “Active until …”, and every administrator and everyone who can manage Security Settings sees the banner.
Afterwards it reads “OFF”, and “Past grants” shows the window and whether it was revoked or expired.
If something goes wrong
- "Support access is already active. Revoke it before granting a new window."
- Only one grant can be live at a time. Revoke the current one first.
- "… belongs to a regular account in your directory — support access needs a dedicated support address."
- Ask Zonitix support for an address that is not one of your own users.
- Support access granted, but the invitation could not be e-mailed
- A one-time link appears on the card, shown only once. Send it to Zonitix support over a secure channel. If no link appears either, revoke and try again once email works.
- The Grant access button stays greyed out
- Check the hours are 1 to 72, the email address is valid, the reason has at least 5 characters, a role is chosen for Act with a role, and the administrator box is ticked if you chose that role.
- Support reports "Support session is read-only" when they try to fix something
- A read-only grant refuses every change, by design. If the fix needs a change, revoke and grant again with Act with a role, choosing the smallest role that covers it.
Still stuck? See When something goes wrong, or Contact Zonitix support.