Custom roles and the audit log

Decide exactly who can delete, export, see project money or others' time, hide fields from a role, and see who changed what.

Both are under Settings > Users & roles (admins). The audit log is in the Professional plan and above; custom roles are in the Business plan.

Custom roles

A custom role starts from Manager, Employee or Viewer and takes away what you switch off:

Create projects (for a Manager base) - new projects and templates.
Delete - tasks, issues, projects, discussions, pages, files, meetings.
Export to Excel - tasks, issues and time.
Project money - the Finance tab, billing, advances, expenses, materials, budgets and rates.
Other people's time - time entries of the projects they manage (their own are always there), and approving time.
Invite clients - client users on the projects they manage.

Hidden fields: tick custom fields the role doesn't see. Its people don't see them on tasks, issues and projects, can't fill them in, and the API leaves them out.

Under Who has a custom role, choose one for each person. Their Projects role becomes the custom role's base. Admins always have every right and never have a custom role. Deleting a role leaves its people with its base role.

Audit log

The Audit log tab lists who did what to the business's setup and data, and when:

users, roles, invitations and client access;
settings: statuses, custom fields, the work calendar, SLA rules, business details;
deletions, restores, imports and emptying the recycle bin;
money: invoices, advances, expenses, billing settings, time approvals;
workflow rules, blueprints, API keys and webhooks;
exports.

Filter by area, person and dates, and download it to Excel. Changes made through the API are marked API. Day-to-day work on tasks is in each project's Activity.