Admin Overview

Everything runtime-configurable lives in the Admin area, reached via the gear button in the header (visible only to roles with any admin-area permission). The URL prefix is /admin/*; old /settings links redirect.

The 18 sections, in 7 groups

Group	Sections
Workspace	General · Appearance & branding
Storage	Storage
Programs	Memberships · Communication · Documents · Verifications (see User guide)
Email	Email · Templates · Campaigns · Email log
Locations	Locations (see User guide)
Access & security	Users & Roles · Sign-in & SSO
Platform	Audit log · Scheduling · Health

Principles

• No file edits, ever. Everything on these pages is stored in the database and takes effect immediately. Only deployment bootstrap (secrets, database URL) belongs in the environment.
• Secrets encrypted at rest. SMTP and cloud-storage credentials are AES-256-GCM encrypted and never returned to the client.
• Permission-gated. Most sections require settings:manage; Locations uses locations:edit, Users & Roles use users:manage / roles:manage, Communication & Templates use communications:edit, and Audit log / Email log use audit:view. Users without the permission don't see the section at all. (Rate-limit and session settings live on the Sign-in & SSO page and are documented in Rate Limits.)
• Audited. Every change lands in the audit log.

Keyboard access

The command palette (Ctrl+K / ⌘K) jumps straight to the most-used admin sections — General, Appearance, Users, Roles, Templates, Audit, Email log, Scheduling.