What this is, and who it is for
A Super-Admin is a person who runs the platform: provisions organizations, sets feature switches and reads the platform ledger. A Super-Admin is a separate identity from any organization's Organization Admin, in a separate application: a Super-Admin sees organizations, counts and switches, never clinical data, and cannot sign in to a trial. This page covers how Super-Admins sign in and how they are added and removed.
| You need | To |
|---|---|
| To be an active Super-Admin | Use any page of the console (every Super-Admin has the same authority; there are no finer roles) |
Where to find it
The console's sign-in page (Trialion Platform · Super-Admin Console) and Platform Admins in its menu (Super-Admin identities that manage the whole platform. Distinct from any organization's Org Admin.).
- The administrator's address. The box starts empty: nothing is remembered.
- Asks for a six-digit code, which is e-mailed to the address.
What you can do
Sign in
- Enter your Work email and choose Send login code.
- Enter the 6-digit code sent to your address and choose Sign in. Use a different email goes back. There is no password.
The code is valid for 10 minutes and allows 5 attempts. The page answers the same way for an address that is not an administrator, so it cannot be used to find out who is one; a code is mailed only to an active Super-Admin. A session's access token lasts 15 minutes and is renewed from a refresh token that lasts 7 days; suspending an administrator ends their sessions at once. The sign-in routes allow 20 requests in 15 minutes from one address, and the rest of the console 240 a minute.
After signing in you land on Organizations. The bare address of the console does the same: it opens Organizations, or the sign-in when nobody is signed in.
- The six digits from the e-mail.
- Goes back to the first step.
The first Super-Admin of a deployment
No migration seeds anybody. Once, on the server host, after the migrations, the operator runs npm run admin:bootstrap -- --email <address> --name "<full name>". It refuses if any platform admin already exists, creates one active Super-Admin and records admin.bootstrapped on the ledger. That person signs in (the code is emailed) and invites a second Super-Admin from Platform Admins. In development, db:seed-dev creates a development administrator, and only on a local database.
Invite a Super-Admin
Invite admin: Full name and Email. The account exists at once and is Invited until the person's first sign-in, then Active. A mail is sent with a link to the console; if the mail cannot be sent, the notice says so (… was invited, but the invitation mail could not be sent … They can still sign in: ask them to open the console and enter their address), and a deployment that sends no mail says that instead. A person can be invited once; an address already registered is refused.
- Invites another Super-Admin; the invitation is e-mailed.
- The person's name.
- Sends the invitation and records it on the platform ledger.
Suspend and restore
The table shows each administrator with Status (Invited, Active or Suspended), Last sign-in and a Suspend or Restore button, with a search.
- Suspend admin (They will be signed out of every device immediately and cannot sign in again until another Super-Admin restores their access. The account is kept, not deleted). Their live sessions are revoked in the same transaction as the status change.
- Restore admin (They will be able to sign in again with a one-time code and will have full Super-Admin access to the whole platform. Sessions that were ended when they were suspended stay ended).
Two refusals keep the platform from locking itself out: you cannot suspend yourself (Ask another Super-Admin to do it; if you are the only one, Invite another admin first), and the last active Super-Admin cannot be suspended.
Every option
A Super-Admin account is never deleted: its id is the attribution on every governed action it took. There are no passwords, no roles inside the console, no single sign-on.
What the system records
On the platform ledger: admin.bootstrapped, admin.invited, admin.login (a successful sign-in), admin.login_refused (a known administrator who is suspended, gave a wrong code or exhausted the attempts; an address nobody holds leaves no entry), admin.suspended, admin.restored. See The platform audit ledger.
What you cannot do, and why
- Suspend yourself or the last active Super-Admin.
- See clinical data. The console shows organization metadata, counts and switches.
- Edit the ledger. The runtime database role can only read and append to it.
- Use the console as an organization's administrator. The two identities, sign-ins and ledgers are separate.
Compliance Q&A
Yes. Every Super-Admin is a named, invited account that signs in with a one-time code; failed attempts by a known account are recorded; suspension ends sessions immediately; no one can suspend themselves or the last active administrator.
Limits: the sign-in rate limit counts in the memory of one process, which is right for the single instance the control plane runs as today; it would have to move to a shared store if the control plane ran as several.
Evidence: control plane server auth and admins (named accounts, one-time code, attempts limited, sessions revoked on suspension, admin.login_refused on the ledger)simulation of 20 Oct 2026, step 1
Related
Provision an organization · The platform audit ledger · The platform console · Configuration