Features
Administration and security
Multi-user, multi-branch and auditable. Data isolation is enforced in the database, not in application code.
What an agency holds is not an ordinary customer list: passports, identity numbers, addresses, sometimes health notes. That is why the question of who can see what was not left as a screen setting. Another agency's records never reach you, and yours never reach them, by any route — and the same boundary applies between your branches.
Nothing left to remember
Another agency's data never becomes visible — and that stays true when a new screen is added.
Every change is attributed
Who changed what and when, with the old and new value — and nobody can skip that record.
Seasons stay separate
One year's tours, programmes and passengers never mix with another's.
Administration and security
7 capabilities
Sub-agents see their own earnings
When sub-agent staff sign in they see only their own bookings, their own passenger count and the commission they have earned; another sub-agent's name never even reaches the list. This is not a screen filter: records outside a sub-agent's scope never reach them by any route. A sub-agent with no rate entered is flagged rather than hidden — “ten passengers and no rate” is what this screen is for.
Bookings › My sub-agent summary
Roles and permissions
Ready-made roles and per-screen customisation. A user without permission never sees that section in the menu.
Settings › Roles
Branch scope
Branch staff see only their own branch's leads, files and passengers.
Audit trail
Who changed what and when, with old and new values.
Settings › Activity log
Season separation
The working year is switched from the top bar; nothing needs restarting.
Screen lock
A screen left open at the counter locks after a set period and reopens with a password.
Settings › Screen lock
Data protection
Passport and identity data stored encrypted, every access logged, retention and export defined.
FAQ
Questions about this module
Can we stop the bookkeeper from seeing booking screens?
Yes — permissions are granted per screen. A screen they cannot see is absent from the menu, and typing the address directly does not open it either.
Is there an answer to "who changed what"?
Every change is recorded with its user, timestamp and previous value. For irreversible actions such as receipts and invoices, leaving a trail is mandatory.
We have several branches — can their data stay separate?
Branch staff see only their own records and head office sees all of them. That boundary also sits in the data rather than on the screen — a branch cannot reach another's records by any route.
Glossary
The language of the trade
Let's set it up together
Tell us how your tours, pricing and team are structured; we will show the demo on a setup that resembles your own data.