Document Auditor Invitations

Not the same feature as External Auditor Access

This page covers a different invitation mechanism from External Auditor Access. External Auditor Access issues a session-scoped magic link (link + 6-digit code) that never creates a user account. The flow on this page instead creates a real, tenant-scoped Auditor user account — the invitee signs in afterwards through the ordinary passwordless OTP login, the same as any other tenant user. Use this flow when the auditor needs standing access to specific documents over time; use External Auditor Access for a time-boxed audit engagement.

How it works

1. A user holding the audit.manage_auditors permission (Admin or QA Team by default) invites an auditor by email and a list of documents to review.
2. The system creates a pending invitation and emails the invitee a single-use accept link: https://<your-eqms>/auditor/accept/<token>.
3. The invitee opens the link, optionally confirms their display name, and accepts. This creates their Auditor account, scoped to the inviting tenant, marks the invitation used, and allocates the documents the invitation was sent for to the new account.
4. From there, the invitee signs in like any other user: request a one-time code by email, enter it, and they’re in — no password is ever set. Their first sign-in lands on the Documents page, where the documents they were invited to review are listed at the top under Assigned to you for review.

Security model

Property	Detail
Token	Generated with a cryptographically secure random generator (secrets.token_urlsafe(32), ~192 bits of entropy). Only its SHA-256 digest is stored — the raw token exists solely in the invite email and is never logged.
Single-use	Accepting an invitation atomically flips it from pending to accepted; a second attempt with the same token — a double-click, a retried request, or the token reused after it was already accepted — is refused.
Expiry	Invitations expire 7 days after they’re sent. Resending gives the invitation a new 7-day window.
Resend and revoke	Resending emails a new link and the previous link stops working. Revoking stops a pending link from being accepted. After accept, each document allocation can be withdrawn separately; the row is kept, marked as revoked.
Generic error	An invalid link is reported with one message — “Invalid or expired invitation” — whether the token was never issued, has expired, or was already used. The accept page cannot and does not distinguish these for the caller.
Rate limiting	The accept endpoint is unauthenticated by necessity (the invitee has no account yet); it throttles repeated attempts per token and per client.
Email addresses	Addresses are not case-sensitive: Jane.Doe@Example.com and jane.doe@example.com are the same auditor. The account is created with the lowercase address, which is the form the sign-in page looks up.
All or nothing	Accepting either completes fully — account created, documents allocated, audit trail written — or changes nothing and leaves the invitation pending. If the address already has an account, acceptance is refused before anything changes: the invitation stays pending (not used up), and you can revoke it and invite a different address.
Tenant scoping	The account created is scoped to the tenant that sent the invitation. There is no way to redeem one tenant’s invitation into another tenant’s account.
Seats	Auditor accounts are seat-exempt — accepting an invitation never consumes a purchased QA or Trainee seat.

External auditors and multiple organizations

An email address can only be linked to one InnoQualis account platform-wide, not one per tenant — external auditors are exactly the people most likely to hit this, since it’s common for one auditor to hold standing access to several customer organizations. Inviting an address that already has an account elsewhere never tells you (the inviting admin) that — invitation creation succeeds identically either way, since it performs no lookup against existing accounts at all. The collision only ever surfaces to the invitee themselves, when they try to accept: if their email already has an account, acceptance is refused and the message on the accept page tells them to ask you to resend the invitation to a different address instead (plus-addressing, e.g. name+yourcompany@example.com, works). See Setting up a second workspace for a different organization for the same guidance from the invitee’s side.

Set up a document auditor invitation (for QA teams)

1. Open Admin → External Auditor Access (/admin?tab=external-auditors). This requires the audit.manage_auditors permission (Admin or QA Team by default).
2. In the Invite a document auditor panel — below the time-boxed external-auditor link panel, and a separate action from it — enter the invitee’s email address.
3. Search for and select the documents that define the invitation’s scope. At least one document is required. Obsolete, superseded and discarded documents cannot be sent for audit; the invitation is refused and names the document.
4. Select Send invitation. The panel shows how many auditor invitations your plan has used (KAN-617); if your plan’s cap is reached, the action is disabled and the panel explains the limit instead of letting the request fail.
5. The invitee receives an email with their personal accept link and has 7 days to use it. The panel confirms Invitation sent only once the email has been handed to the mail server. If the email could not be sent, the panel warns Invitation not sent instead and keeps the form filled: the invitation is cancelled, does not use one of your plan’s auditor slots, and you can try the same address again straight away. An invitation that expired unused also no longer blocks inviting that address again.
6. When the invitee accepts, the documents you selected are allocated to their account automatically. A document deleted, retired (obsolete or superseded) or discarded between the invitation and the acceptance is skipped. The accept page tells the invitee how many documents are waiting for them; a document still in draft is allocated but not counted until it is approved, because the auditor cannot open drafts. To allocate additional documents later, use POST /api/log-trail/auditors/allocate (there is no Admin screen for that step yet). To withdraw an allocation, use Document allocations on the same Admin tab, or POST /api/log-trail/auditors/allocations/{id}/revoke with a reason.

Note

The documents you select are allocated to the auditor account, and the allocation decides whose history the account can read: the auditor reads the History of each document allocated to them, and of nothing else. That covers the document’s own changes, its change requests and its approval workflow. A revoked allocation no longer grants History. The History of any other document, and of deviations, CAPAs and every other record, is not available to them; those records cannot be allocated, and their History section tells the auditor so. Change controls are the exception: an administrator can share a specific change control with the auditor, read-only, which opens it and its History (Share a change control with an auditor). Opening records is not narrowed: the account holds the standard Auditor role, so it can still open any non-draft document and any record the Auditor role can read. It cannot see the organisation-wide audit trail.

The same action is available directly via POST /api/log-trail/auditors/invite with the invitee’s email and a document_ids list, for integrations that call the API rather than using the Admin screen. Its response carries email_sent: false means the email was not sent and the invitation was expired at once (status: "expired").

Manage sent invitations

Below the invite form, Sent invitations lists every invitation your organization has sent, newest first, with its status:

Status	Meaning	Actions
Pending	Sent and not yet accepted; the link still works.	Resend, Revoke
Expired	Not accepted within 7 days, or the email could not be sent.	Resend
Accepted	The invitee accepted and their Auditor account exists.	None
Revoked	Cancelled by an administrator; the link no longer works.	None

• Resend emails the invitee a new accept link with a fresh 7-day expiry. The link from the earlier email stops working, so use this when an invitee lost the email or the invitation expired. Resending an expired invitation uses one of your plan’s auditor slots again.
• Revoke asks you to confirm, then cancels a pending invitation so its link can no longer be accepted. A revoked invitation frees its plan slot. To invite the same person again, send a new invitation.

Every invitation event (sent, resent, revoked, accepted) is recorded in the audit trail against the invitation.

Manage document allocations

Below the invitation list, Document allocations lists every document that has been allocated to an Auditor account in your organization — including withdrawn ones, which stay visible as audit evidence.

Status	Meaning	Actions
Active	The auditor reads this document’s History.	Revoke
Revoked	An administrator withdrew the allocation.	None

• Revoke asks for a reason and a second click, then withdraws the allocation. The auditor can still open the document (the Auditor role is tenant-wide for non-draft documents) but can no longer read its History. The row stays on the list, marked Revoked with the date. The withdrawal — who, when and the reason you gave — is recorded in the document’s audit trail.
• The same auditor can be allocated the same document again later; the new allocation is a new row.

What the invitee sees

1. Opening the link shows a short form asking for their name (optional — the account still gets created without one, using a placeholder derived from their email address).
2. Selecting Accept invitation creates the account and shows a confirmation.
3. The confirmation says how many documents are waiting for their review. Selecting Continue to sign in takes them to the standard login page with their email already filled in — they only need to request and enter their one-time code.
4. After signing in they land on the Documents page, with the documents they were invited to review listed first under Assigned to you for review. As an internal auditor they can also open any other non-draft document in the register, but they read the History only of the documents currently allocated to them. A revoked allocation disappears from that list and no longer grants History. Each of those reads is recorded in the audit trail.
5. If the link is invalid, expired, revoked, or already used, the page shows a single explanation and points them back to whoever invited them to request a new one.
6. If their email already has an account elsewhere on the platform, acceptance is refused with a different message explaining that and suggesting they ask whoever invited them to resend the invitation to a different address (see the note above).

Related topics

• External Auditor Access — the separate, session-scoped magic-link flow for time-boxed audit engagements.
• Creating Audits