Troubleshooting & FAQ

User problems are almost always about roles or invitations: which role grants what, why an invitation does not arrive, and why someone sees nothing after logging in. Strict Mode adds a second layer of access control, which is the usual cause of the last one.

Frequently asked questions

What's the difference between user roles?

Three global roles exist, and each one is strictly a superset of the last: Read Only, Regular, and Super User.

Role-based access control in Tidal Control:

Read Only User:

• Access: Can view all compliance data (controls, assets, risks)
• Limitations: Cannot change anything, execute tasks, or upload evidence
• Use: External auditors, management oversight, reporting specialists
• Strict Mode: Unchanged

Regular User:

• Access: Everything from Read Only plus execution rights
• Capabilities: Execute tasks, upload evidence, be assigned as owner
• Limitations: Cannot manage other users or change global settings
• Use: Compliance staff, control owners, daily users
• Strict Mode: Needs object-level roles for access

Super User (Administrator):

• Access: Full system rights
• Capabilities: Manage users, global settings, all functionalities
• Responsibilities: System management, user onboarding, configuration
• Use: IT administrators, compliance managers, implementation specialists
• Strict Mode: Unchanged

How can a user update their own profile?

Users manage their own profile through Keycloak, reached from the profile icon in the top-right corner.

Keycloak account access for personal data:

Access to account settings:

1. Log in to Tidal Control
2. Click profile icon top right (user avatar)
3. Select "My preferences" from dropdown menu
4. Keycloak interface opens in new tab

Editable personal information:

• Email - Contact address for system notifications
• First name / Last name - Names as displayed in Tidal interface
• Password - Secure password change
• Two-factor authentication - Authenticator app configuration

What users cannot change:

• Username - Login identifier (often email address)
• Global user role - Only Super Users can change roles
• Object-level access - Only Object Owners can assign object roles
• Organisation settings - System configuration is reserved for administrators

Can a user change their own role?

No, users cannot change their own global role for security reasons and to ensure organisational control.

Role change process:

• Only Super Users can change global roles
• Role change happens via Users overview page
• Immediate effect - Changes are active immediately
• Audit trail - All role changes are logged

Strict Mode object-level roles:

• Object Owners can assign Viewer/Contributor roles
• Users cannot change their own object-level roles
• Escalation via Object Owner or Super User

What happens to data from deleted users?

Deleting a user removes their login, not their history. Every control, task, and piece of evidence they touched stays intact.

Data integrity preserved when deleting users:

What remains:

• All compliance data - Controls, assets, risks, tasks
• Historical evidence - Uploads and documentation
• Audit trails - Complete activity history
• Tasks and assessments - Completed and ongoing work

What changes:

• Ownership display - Shows "Unknown user" instead of name
• Assignments - Remain but user can no longer respond
• Notifications - Automatically stop to deleted account
• Access - Immediately blocked from all systems

Practical impact:

• Ongoing tasks - Must be manually transferred
• Ownership - Assign new owners for continuity
• Teamwork - Colleagues must take over tasks
• Reporting - Historical contributions remain visible

How does Strict Mode work versus normal mode?

Normal mode gives every Regular User access to all compliance objects; Strict Mode restricts that access to objects they're explicitly assigned to.

Access control differences:

Normal mode (default):

• Regular Users see all compliance objects
• Global roles determine what users can do
• Open access - All objects visible to all users
• Simple rights - Three roles for entire system

Strict Mode (enhanced security):

• Zero-trust principle - No access unless explicitly granted
• Object-level roles - Viewer, Executor, Assessor, Owner per object
• Granular control - Exact access per compliance object
• Compartmentalization - Users only see assigned objects

When to choose Strict Mode:

• Large organisations with many departments
• Sensitive compliance data requiring compartmentalization
• Legal requirements for data access control

Common problems

User cannot login after invitation

Start by checking whether the user is active, was actually invited, and received the email at the right address.

Diagnosis and solution for login problems:

Check account status:

1. Verify in Users table - Is user visible and active?
2. Check invitation status - Has "Send invite" been executed?
3. Confirm email receipt - Did user receive welcome email?
4. Validate email address - Is address correct in Users table?

Common causes:

• Invitation not sent - Manage menu "Send invite" not yet used
• Invitation expired - User didn't accept invitation within 7 days
• Email not received - Spam filter or wrong email address
• Password not set - User didn't complete Keycloak activation
• Account timing - Invitation can take several minutes

Solution steps:

1. Resend invitation via Manage menu
2. Check spam folder of user
3. Verify email address and correct if needed
4. Guide password setup via Keycloak interface
5. Test login process together with user

Invitation email doesn't arrive

Check spam first, then the email address on file, then your organisation's own mail filtering.

Email delivery problem solving:

Initial diagnosis:

• Check spam/junk folder - Automatic filters can block email
• Verify email address - Typos in Users table
• Check organisation firewall - Email security can block Tidal emails
• Validate email server - Organisation email server problems

Troubleshooting steps:

1. Correct email address in Users table if needed
2. Send invite again via Manage menu
3. Whitelist Tidal domains in organisation email security
4. Try alternative email address for testing
5. Contact IT support for email server configuration

Alternative solutions:

• Manual account setup - Super User helps with password setup
• IT escalation - System administrator investigates email delivery

User has wrong access rights

Check the user's global role in the Users overview and change it from the Role dropdown if it's wrong.

Access rights diagnosis and correction:

Check global role:

1. Go to Users overview and find user
2. Verify current role in Role column
3. Change role if needed via dropdown menu
4. Test new rights with user

Strict Mode specific check:

• Object-level roles - Does user have correct Executor/Assessor/Owner role?
• Object assignment - Is user even assigned to relevant objects?
• Active objects - Are objects themselves active and available?
• Inheritance - Are rights correctly inherited from related objects?

Solution per scenario:

• Too few rights - Upgrade global role or add object-level roles
• Too many rights - Downgrade to appropriate role for function
• Inconsistent access - Review all object assignments systematically
• Timing issues - Wait several minutes after role changes

Strict Mode access problems

User sees no objects in Strict Mode:

Diagnosis steps:

1. Check global role - Is user Regular User or higher?
2. Verify object assignments - Does user have object-level roles?
3. Check object status - Are objects themselves active?
4. Check Strict Mode status via green indicator

Solution:

• Super User assigns correct object-level roles
• Object Owner can grant access within own scope

User cannot execute tasks:

Possible causes:

• Viewer role instead of Contributor role
• Object specific restrictions set by owner
• Task assignment to wrong user

Solution steps:

1. Verify object-level role in object page
2. Upgrade to Contributor if needed
3. Check task assignment and deadline status
4. Contact Object Owner for role escalation

Keycloak account problems

Most Keycloak issues are password resets gone wrong; the reset link goes out from the Keycloak login page, not from Tidal itself.

Authentication and profile management issues:

Password reset problems:

1. Go to Keycloak login page via Tidal Control
2. Click "Forgot Password" link
3. Enter email address and send reset
4. Check email including spam folder
5. Follow reset instructions in received email

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.