Troubleshooting & FAQ

Access problems are almost always about roles or invitations: which role grants what, why an invitation does not arrive, and why someone sees nothing after logging in. Strict Mode adds a second layer of access control, which is the usual cause of the last one.

Frequently asked questions

What is the difference between the roles?

Four global roles exist. Basic User stands on its own for staff who only accept policies. The other three are each a superset of the last: Read Only, Regular, and Super User.

Role-based access control in Tidal Control:

Basic User:

• Access: Onboarding and the incidents they submitted themselves
• Limitations: Cannot reach controls, assets, risks or reports
• Use: Employees who only need to read and accept their policies
• Strict Mode: Unchanged

Read Only User:

• Access: Can view all compliance data (controls, assets, risks)
• Limitations: Cannot change anything, execute tasks, or upload evidence
• Use: External auditors, management oversight, reporting specialists
• Strict Mode: Unchanged

Regular User:

• Access: Everything from Read Only plus execution rights
• Capabilities: Execute tasks, upload evidence, be assigned as owner
• Limitations: Cannot manage other users or change global settings
• Use: Compliance staff, control owners, daily users
• Strict Mode: Needs object-level roles for access

Super User (Administrator):

• Access: Full system rights
• Capabilities: Manage users, global settings, all functionalities
• Responsibilities: System management, user onboarding, configuration
• Use: IT administrators, compliance managers, implementation specialists
• Strict Mode: Unchanged

How can a user update their own profile?

Users manage their own profile through Keycloak, reached from the profile icon in the top-right corner.

Keycloak account access for personal data:

Access to account settings:

1. Log in to Tidal Control
2. Click profile icon top right (user avatar)
3. Select "My preferences" from dropdown menu
4. Keycloak interface opens in new tab

Editable personal information:

• Email - Contact address for system notifications
• First name / Last name - Names as displayed in Tidal interface
• Password - Secure password change
• Two-factor authentication - Authenticator app configuration

What users cannot change:

• Username - Login identifier (often email address)
• Global user role - Only Super Users can change roles
• Object-level access - Only Object Owners can assign object roles
• Organisation settings - System configuration is reserved for administrators

Can a user change their own role?

No, users cannot change their own global role for security reasons and to ensure organisational control.

Role change process:

• Only Super Users can change global roles
• Role change happens from the person's Portal access field in Personnel
• Immediate effect - Changes are active immediately
• Audit trail - All role changes are logged

Strict Mode object-level roles:

• Object Owners can assign Viewer/Contributor roles
• Users cannot change their own object-level roles
• Escalation via Object Owner or Super User

What happens to someone's data when access is revoked?

Revoking access removes the login, not the history. Every control, task, and piece of evidence they touched stays intact.

Data integrity preserved when deleting users:

What remains:

• All compliance data - Controls, assets, risks, tasks
• Historical evidence - Uploads and documentation
• Audit trails - Complete activity history
• Tasks and assessments - Completed and ongoing work

What changes:

• The person stays in personnel - Their record, groups and policy checks are untouched
• Assignments - Remain, but they can no longer respond to them
• Notifications - Stop, because there is no account to send them to
• Access - Blocked immediately

Practical impact:

• Ongoing tasks - Must be manually transferred
• Ownership - Assign new owners for continuity
• Teamwork - Colleagues must take over tasks
• Reporting - Historical contributions remain visible

How does Strict Mode work versus normal mode?

Normal mode gives every Regular User access to all compliance objects; Strict Mode restricts that access to objects they're explicitly assigned to.

Access control differences:

Normal mode (default):

• Regular Users see all compliance objects
• Global roles determine what users can do
• Open access - All objects visible to all users
• Simple rights - Three roles for entire system

Strict Mode (enhanced security):

• Zero-trust principle - No access unless explicitly granted
• Object-level roles - Viewer, Executor, Assessor, Owner per object
• Granular control - Exact access per compliance object
• Compartmentalization - Users only see assigned objects

When to choose Strict Mode:

• Large organisations with many departments
• Sensitive compliance data requiring compartmentalization
• Legal requirements for data access control

Common problems

Someone cannot log in after their invitation

Start by checking whether the user is active, was actually invited, and received the email at the right address. All of this needs a Super User: the Access column and the Portal access field are theirs alone.

Diagnosis and solution for login problems:

Check account status:

1. Verify on the People tab - Is the person there, and does the Access column show a role?
2. Check Portal access - Is it still on No login?
3. Confirm email receipt - Did they receive the welcome email?
4. Validate email address - Is the address correct on their Details tab?

Common causes:

• No login yet - Portal access is still on No login
• Invitation expired - User didn't accept invitation within 7 days
• Email not received - Spam filter or wrong email address
• Password not set - User didn't complete Keycloak activation
• Account timing - Invitation can take several minutes

Solution steps:

1. Resend the invitation from the actions menu in the person's detail panel
2. Check spam folder of the person
3. Verify email address and correct if needed
4. Guide password setup via Keycloak interface
5. Test login process together with user

Invitation email doesn't arrive

Check spam first, then the email address on file, then your organisation's own mail filtering.

Email delivery problem solving:

Initial diagnosis:

• Check spam/junk folder - Automatic filters can block email
• Verify email address - Typos on the person's Details tab
• Check organisation firewall - Email security can block Tidal emails
• Validate email server - Organisation email server problems

Troubleshooting steps:

1. Correct email address on the person's Details tab if needed
2. Resend the invitation from the actions menu in their detail panel
3. Whitelist Tidal domains in organisation email security
4. Try alternative email address for testing
5. Contact IT support for email server configuration

Alternative solutions:

• Manual account setup - Super User helps with password setup
• IT escalation - System administrator investigates email delivery

Someone has the wrong access rights

Check their global role on the People tab and change it from the Portal access field if it is wrong.

Access rights diagnosis and correction:

Check global role:

1. Go to Personnel and open the person
2. Verify current role in the Access column
3. Change the role if needed from Portal access
4. Test the new rights with them

Strict Mode specific check:

• Object-level roles - Does user have correct Executor/Assessor/Owner role?
• Object assignment - Is user even assigned to relevant objects?
• Active objects - Are objects themselves active and available?
• Inheritance - Are rights correctly inherited from related objects?

Solution per scenario:

• Too few rights - Upgrade global role or add object-level roles
• Too many rights - Downgrade to appropriate role for function
• Inconsistent access - Review all object assignments systematically
• Timing issues - Wait several minutes after role changes

Strict Mode access problems

User sees no objects in Strict Mode:

Diagnosis steps:

1. Check global role - Is user Regular User or higher?
2. Verify object assignments - Does user have object-level roles?
3. Check object status - Are objects themselves active?
4. Check Strict Mode status via green indicator

Solution:

• Super User assigns correct object-level roles
• Object Owner can grant access within own scope

User cannot execute tasks:

Possible causes:

• Viewer role instead of Contributor role
• Object specific restrictions set by owner
• Task assignment to wrong user

Solution steps:

1. Verify object-level role in object page
2. Upgrade to Contributor if needed
3. Check task assignment and deadline status
4. Contact Object Owner for role escalation

Keycloak account problems

Most Keycloak issues are password resets gone wrong; the reset link goes out from the Keycloak login page, not from Tidal itself.

Authentication and profile management issues:

Password reset problems:

1. Go to Keycloak login page via Tidal Control
2. Click "Forgot Password" link
3. Enter email address and send reset
4. Check email including spam folder
5. Follow reset instructions in received email

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.