Service operations
Cepter platform administrator
Sees aggregate workspace, plan, membership, waitlist, and workflow counts. Does not receive routine access to customer PDFs, signatures, recipient links, field values, or completed copies.
Access and privacy
Know who can see and manage each workflow.
Cepter separates platform operations, customer workspace administration, members, and recipients. These boundaries keep governance visible without turning every Team workspace into an open document folder.
One customer workspace
Workspace owner or administrator
Sees every workflow in that workspace with its creator clearly labeled. Oversight is read-only for another member’s workflow and never permits signing, sending, or impersonating that member.
Their own work
Workspace member
Creates and manages their own workflows and sees agreements they received. Membership alone does not reveal another member’s private workflows.
A specific signing request
Recipient
Uses a private link to complete only assigned fields and receives the completed package after every required signer finishes. A sender seat is not required.
Rules and answers
How Cepter access works.
Are a Cepter platform administrator and a Team administrator the same?＋
No. Platform access is a separately authorized Cepter operations role. A Team owner or administrator manages only their own customer workspace. Being a customer owner does not grant platform access.
Can a Team owner or administrator see members’ signature requests?＋
Yes. Owners and administrators have labeled, read-only oversight of every workflow in their workspace for contract management, support, and abuse prevention. The creator is always identified. They cannot sign, send, or impersonate the creator.
Can ordinary Team members see one another’s work?＋
No. Members see workflows they created, agreements they received, and items deliberately shared with them. Team membership by itself does not make peer workflows visible.
Who can invite or remove Team members?＋
The workspace owner can manage administrators and members. Workspace administrators can manage ordinary members but cannot appoint or remove other administrators or the owner. Removing access does not erase retained agreements or audit evidence.
How do plan allowances work?＋
Allowances belong to the workspace. Personal includes one sender. Team includes multiple sender seats and a pooled package allowance. Recipients do not consume sender seats, and a package is counted when its sender explicitly sends it.
Does a signer need a paid account?＋
No. A recipient can sign using the private link. After signing, they may request a Free Preview account to keep a received-agreements library and send their own requests. Cepter reviews the request and sends a secure setup link after approval; requesting an account is never required to complete the agreement.
What happens when a draft is deleted?＋
An unsent draft first moves to Trash so an authorized user can recover an accidental deletion during the retention window. Sent and completed agreements are not casually deleted; they follow voiding, retention, legal-hold, and audited purge rules.
What can Cepter staff see in platform analytics?＋
Authorized platform operators see aggregate customer, plan, membership, waitlist, and workflow counts needed to run the service. The operations dashboard does not return customer identities or document content.
How are important changes recorded?＋
Security- and signing-relevant state changes write append-only, hash-chained events. This supports investigation and evidence integrity; it does not expand who may read a customer’s documents.
This page explains the current V1 access model. Contracted Enterprise policies may add stricter controls, but they never silently weaken these privacy boundaries.