Run The Board — Platform

Detail

Tenant healthComputed by the daily job — can be up to 24h old, unlike the live signals on the Tenants page.

Tenant	Active users (7d)	Last activityThe board tables carry no write timestamp, so this is derived from roster signing and notifications and undercounts pure board editing — the "Last scheduled day" shown beside it is what distinguishes an abandoned board from an un-signed one.	Zero-activityThe only leading indicator of churn in the console — everything else reports churn that already happened.	Computed

Stale means the last successful run is older than the job's threshold — which catches a job that silently stopped, a quieter failure than one that errors.

Stripe preflight

	Check	Detail

All tenants

	Tenant	Health	Plan	ORs (30d max)Maximum room count on any single day in the trailing 30-day window — what the tier is derived from.	Users	Utilization	Last active	Status

At a glance

Subscription

Customer detailsSubdomain rename isn't a field here — live sessions, bookmarked URLs, and Stripe metadata all derive from it. It's a migration, not an edit.

Organization name Hospital Contact name Group name

Billing emailUsed for the checkout link, dunning notices, and Stripe invoices. Save details also pushes this to Stripe, keeping both in sync.

Refund a payment

Invoice

Loading…

Amount ($ — full or partial, validated against the invoice total) Reason (required — goes in the audit row and Stripe's refund metadata) Type the subdomain to confirm

No platform mail is sent — Stripe's own refund receipt is the customer notice.

Signup requests

Hospital	Subdomain	Tier	Billing email	Admin email	Admin user	Status	Created

Provision queue

Every provisioning attempt — automatic (Stripe webhook) or manual — lands here.

Subdomain	Hospital	State	Source	Attempts	Error	Created

Signed agreementsEvery public signup accepts the Privacy Policy, Terms of Service, and Liability Waiver — this is the signed record of who, when, and which version of each document. Rows are kept permanently and stay searchable after a tenant is deleted.

Search by subdomain, email, name, hospital, signup id, or tenant id. Blank shows the most recent signatures.

Signed	Document	Version	Subdomain	Tenant	Signed by	Email	Hospital	IP

Trial grantsOne trial per email address. Flagged rows are a repeat signup on a domain with a live grant — often a legitimate multi-facility case, not abuse. Use "Grant trial" on the flagged row to approve.

Flagged only (same-domain repeat)

Email	Domain	Hospital	Subdomain	Granted	Source	Status	Note

Platform usersViewer: read-only. Operator: tenant ops, messages, acknowledgements, provisioning. Owner: also pricing, promo codes, refunds, suspend/teardown, config, admin management. The last owner can't be demoted or removed from here — only via psql.

Username	Role	Created	2FA	Recovery codes left

Recent activity

When	Actor	Action	Subdomain	Result

TiersDrives Stripe checkout and the public pricing page — keep listed prices matching what Stripe actually charges.

Tier	Band	Label	Monthly	Annual	Stripe (monthly)	Stripe (annual)	Updated

Tenants billed above or below their trailing-30-day OR max, plus non-paying accounts. Recomputed live on every load; nothing here sends mail.

Compose

Subject Reply-To (optional) Body (plain text)

AudienceChip counts and the actual send use the same resolver — a chip's number is exactly who a send would reach.

Recipient group Tier

Search

Debounced ~200ms — each search re-queries the server, not a local filter.

	Hospital	Org	Tier	Status	Billing email

Preview — as it will be sent

Subject

—

Body

—

Send historyThe only record that a price-change notice was ever sent — nothing else logs it.

Sent	Subject	Filter	Tenants	Addresses	Batches	Actor	Result

All codes

Code	Discount	Restriction	Redemptions	Status	Created

Detail

Tenant healthComputed by the daily job — can be up to 24h old, unlike the live signals on the Tenants page.

Stripe preflight

All tenants

Needs attention

At a glance

Health

Subscription

Customer detailsSubdomain rename isn't a field here — live sessions, bookmarked URLs, and Stripe metadata all derive from it. It's a migration, not an edit.

Over-band graceApply now moves the tier immediately (prorated). Extend grace pushes the deadline one cycle. Close ends the episode without touching money.

Usage below billing

Refund the proration credit

Refund a payment

Cancel subscription

Tenant admin accountsThis console never displays or sets a password, and the reset token never reaches the browser — only "sent." The link points at the tenant's own subdomain, never the platform host.

AccessBilling read-only (past_due/canceled) leaves the board viewable; suspension blocks access entirely. Suspend and cancel are independent — neither triggers the other.

Retention clockNothing is deleted until both notices are recorded as delivered. The clock reaching zero only queues a teardown — a human still runs it.

Remove tenant

Single sign-onPer-tenant OIDC sign-in. Only an owner can save; operators can read the policy and run a dry-run Test sign-in.

Feature flagsOne `app_config` key holds every flag's value for this tenant (§21, docs/tenant-scale-hardening-plan-2026-09-14.md). Saving writes the WHOLE set, never a single flag — every box reflects what would be saved, not just the one you clicked.

Mail sent to this tenant

Signup requests

Provision queue

Agreements

Signed agreementsEvery public signup accepts the Privacy Policy, Terms of Service, and Liability Waiver — this is the signed record of who, when, and which version of each document. Rows are kept permanently and stay searchable after a tenant is deleted.

Trials

Trial grantsOne trial per email address. Flagged rows are a repeat signup on a domain with a live grant — often a legitimate multi-facility case, not abuse. Use "Grant trial" on the flagged row to approve.

Users

Platform usersViewer: read-only. Operator: tenant ops, messages, acknowledgements, provisioning. Owner: also pricing, promo codes, refunds, suspend/teardown, config, admin management. The last owner can't be demoted or removed from here — only via psql.

Recent activity

Pricing

TiersDrives Stripe checkout and the public pricing page — keep listed prices matching what Stripe actually charges.

Compose

AudienceChip counts and the actual send use the same resolver — a chip's number is exactly who a send would reach.

Preview — as it will be sent

Send historyThe only record that a price-change notice was ever sent — nothing else logs it.

Promo codes

All codes

Configuration

Welcome back

Detail

Tenant healthⓘComputed by the daily job — can be up to 24h old, unlike the live signals on the Tenants page.

Stripe preflight

All tenants

Needs attention

At a glance

Health

Subscription

Customer detailsⓘSubdomain rename isn't a field here — live sessions, bookmarked URLs, and Stripe metadata all derive from it. It's a migration, not an edit.

Over-band graceⓘApply now moves the tier immediately (prorated). Extend grace pushes the deadline one cycle. Close ends the episode without touching money.

Usage below billing

Refund the proration credit

Refund a payment

Cancel subscription

Tenant admin accountsⓘThis console never displays or sets a password, and the reset token never reaches the browser — only "sent." The link points at the tenant's own subdomain, never the platform host.

AccessⓘBilling read-only (past_due/canceled) leaves the board viewable; suspension blocks access entirely. Suspend and cancel are independent — neither triggers the other.

Retention clockⓘNothing is deleted until both notices are recorded as delivered. The clock reaching zero only queues a teardown — a human still runs it.

Remove tenant

Single sign-onⓘPer-tenant OIDC sign-in. Only an owner can save; operators can read the policy and run a dry-run Test sign-in.

Feature flagsⓘOne `app_config` key holds every flag's value for this tenant (§21, docs/tenant-scale-hardening-plan-2026-09-14.md). Saving writes the WHOLE set, never a single flag — every box reflects what would be saved, not just the one you clicked.

Mail sent to this tenant

Signup requests

Provision queue

Agreements

Signed agreementsⓘEvery public signup accepts the Privacy Policy, Terms of Service, and Liability Waiver — this is the signed record of who, when, and which version of each document. Rows are kept permanently and stay searchable after a tenant is deleted.

Trials

Trial grantsⓘOne trial per email address. Flagged rows are a repeat signup on a domain with a live grant — often a legitimate multi-facility case, not abuse. Use "Grant trial" on the flagged row to approve.

Users

Platform usersⓘViewer: read-only. Operator: tenant ops, messages, acknowledgements, provisioning. Owner: also pricing, promo codes, refunds, suspend/teardown, config, admin management. The last owner can't be demoted or removed from here — only via psql.

Recent activity

Pricing

TiersⓘDrives Stripe checkout and the public pricing page — keep listed prices matching what Stripe actually charges.

Compose

AudienceⓘChip counts and the actual send use the same resolver — a chip's number is exactly who a send would reach.

Preview — as it will be sent

Send historyⓘThe only record that a price-change notice was ever sent — nothing else logs it.

Promo codes

All codes

Configuration

Tenant healthComputed by the daily job — can be up to 24h old, unlike the live signals on the Tenants page.

Customer detailsSubdomain rename isn't a field here — live sessions, bookmarked URLs, and Stripe metadata all derive from it. It's a migration, not an edit.

Over-band graceApply now moves the tier immediately (prorated). Extend grace pushes the deadline one cycle. Close ends the episode without touching money.

Tenant admin accountsThis console never displays or sets a password, and the reset token never reaches the browser — only "sent." The link points at the tenant's own subdomain, never the platform host.

AccessBilling read-only (past_due/canceled) leaves the board viewable; suspension blocks access entirely. Suspend and cancel are independent — neither triggers the other.

Retention clockNothing is deleted until both notices are recorded as delivered. The clock reaching zero only queues a teardown — a human still runs it.

Single sign-onPer-tenant OIDC sign-in. Only an owner can save; operators can read the policy and run a dry-run Test sign-in.

Feature flagsOne `app_config` key holds every flag's value for this tenant (§21, docs/tenant-scale-hardening-plan-2026-09-14.md). Saving writes the WHOLE set, never a single flag — every box reflects what would be saved, not just the one you clicked.

Signed agreementsEvery public signup accepts the Privacy Policy, Terms of Service, and Liability Waiver — this is the signed record of who, when, and which version of each document. Rows are kept permanently and stay searchable after a tenant is deleted.

Trial grantsOne trial per email address. Flagged rows are a repeat signup on a domain with a live grant — often a legitimate multi-facility case, not abuse. Use "Grant trial" on the flagged row to approve.

Platform usersViewer: read-only. Operator: tenant ops, messages, acknowledgements, provisioning. Owner: also pricing, promo codes, refunds, suspend/teardown, config, admin management. The last owner can't be demoted or removed from here — only via psql.

TiersDrives Stripe checkout and the public pricing page — keep listed prices matching what Stripe actually charges.

AudienceChip counts and the actual send use the same resolver — a chip's number is exactly who a send would reach.

Send historyThe only record that a price-change notice was ever sent — nothing else logs it.