Rental Property Team Management: Roles and Permissions
Estavo supports multi-user access with five role-based permission levels — Owner, Manager, Accountant, Maintenance, and Viewer. Each person gets their own login with access scoped to exactly what their role requires. No shared passwords, no over-exposure of sensitive data.
This is designed for real-world landlord teams: a self-managing landlord (Owner), a part-time property manager (Manager), a CPA at tax season (Accountant), a maintenance coordinator (Maintenance), and an investor partner who wants visibility but not edit access (Viewer).
Team Member Limits by Plan
| Plan | Team members |
|---|---|
| Free | 1 (just you) |
| Host | 2 |
| Investor | 5 |
| Portfolio | 15 |
| Enterprise | Unlimited |
How to Invite a Team Member
Go to Settings → Team → Invite member
Enter their email address and choose a role
Select the role that matches their actual responsibilities. When in doubt, use the most restrictive role that still lets them do their job.
Send the invitation
Click Send invite. Estavo emails them an invitation link that expires in 7 days. They click the link, create a password, and are added to your organization.
Adjust or remove at any time
Go to Settings → Team to change any team member’s role or remove them. Role changes take effect immediately — no re-login required.
If an invitation expires (7-day limit), go to Settings → Team & Access, find the pending invite in the Pending Invites section, and click Resend. You can also click Revoke to cancel a pending invite before it’s accepted.
Pending Invitations
Invitations that haven’t been accepted yet appear in a separate Pending Invites section below your active members list. Each pending invite shows:
- The email address invited
- Who sent the invite
- The assigned role
- Days until expiry (shown in red if fewer than 3 days remain)
From a pending invite you can:
- Resend — sends a fresh invitation email with a new 7-day window
- Revoke — cancels the invite; the link in their email will no longer work
The Five Roles Explained
Owner
Full access to everything — properties, units, transactions, reports, access credentials, billing, and team management. Assign this only to yourself or a co-owner. The initial account creator is always an Owner.
Manager
The working property manager role. Can do virtually everything an Owner can do except manage billing, delete the organization, or invite/remove team members. Appropriate for a property manager you’ve hired, a business partner, or a co-investor who’s actively involved in operations.
Key distinction: Managers can view access credentials (WiFi, door codes). Every reveal is logged.
Accountant
Read-only access to all financial data. Can view all transactions, run P&L reports, and export Schedule E data. Cannot add or edit properties, transactions, or obligations. Cannot see access credentials.
Designed for your CPA, bookkeeper, or a family member who handles your taxes. Give them this role at tax season and they can pull everything they need without touching anything they shouldn’t.
Maintenance
Work order access only. Can create and manage maintenance requests, update work order status, assign vendors, and manage the vendor list. Has no access to financial data, transaction ledger, or access credentials.
Appropriate for a maintenance coordinator, a building superintendent, or a trusted handyman who logs their own work orders.
Viewer
Read-only access to properties, units, today view, and transaction ledger. Cannot edit anything. Cannot see access credentials or export reports.
Appropriate for a passive investor partner, a lender, or anyone who needs portfolio visibility without operational access.
Full Permission Matrix
| Permission | Owner | Manager | Accountant | Maintenance | Viewer |
|---|---|---|---|---|---|
| View properties & units | ✓ | ✓ | ✓ | ✓ | ✓ |
| Add / edit / delete properties | ✓ | ✓ | — | — | — |
| View all transactions | ✓ | ✓ | ✓ | — | ✓ |
| Add / edit transactions | ✓ | ✓ | — | — | — |
| View and export P&L + Schedule E | ✓ | ✓ | ✓ | — | — |
| View obligations | ✓ | ✓ | ✓ | — | ✓ |
| Add / edit obligations | ✓ | ✓ | — | — | — |
| View work orders | ✓ | ✓ | — | ✓ | ✓ |
| Create / update work orders | ✓ | ✓ | — | ✓ | — |
| Manage vendor list | ✓ | ✓ | — | ✓ | — |
| View access credentials | ✓ | ✓ | — | — | — |
| Invite / remove team members | ✓ | — | — | — | — |
| Manage billing & subscription | ✓ | — | — | — | — |
Access credentials (WiFi passwords, door codes) are only visible to Owner and Manager roles. Every credential reveal is permanently logged in the audit trail — who viewed it and when. This applies even to Owner-role users.
Audit Log
Estavo automatically logs sensitive actions:
- Every access credential reveal (user, timestamp, which credential)
- Every team member invitation and removal
- Every plan upgrade or billing change
The audit log is at Settings → Audit log and is only visible to the Owner role.
Removing a Team Member
Go to Settings → Team, click the team member, and click Remove from organization. Their account is deactivated and access revoked immediately. All their historical activity (transactions they created, work orders they logged) is retained — removing them doesn’t erase their work.
Frequently Asked Questions
Can a property manager see financial data in Estavo?
Yes — the Manager role has full financial access (transactions, reports, obligations). If you want to give a property manager work order access only (no financials), use the Maintenance role instead.
Can my accountant or CPA access Estavo directly?
Yes. Invite them with the Accountant role. They can view all transactions, run P&L reports, and export Schedule E data directly. This is faster than exporting a spreadsheet and emailing it at year-end.
Can I have two owners in one Estavo account?
The Owner role can be assigned to multiple team members. Your co-investor or co-owner can have the Owner role, giving them the same full access you have. Both count toward your plan’s team member limit.
What happens to a team member’s data if I remove them?
Nothing is deleted. Transactions they created, work orders they logged, and any other activity stays in your account. You’re removing their login access, not their historical contributions.
Is role-based access available on the free plan?
The free plan is single-user only — no team members. To invite any team member, you need at least the Host plan (2 members, $19/month). Full role-based access control (Accountant, Maintenance, Viewer roles with granular permissions) requires the Investor plan or above ($59/month). See Plans & Pricing.