Team Workspaces: Inviting People and Keeping Access Under Control

A small finance team’s account management problems are rarely dramatic. Someone new joins and needs access by this afternoon, not after a ticket clears. Someone forgets a password on a Friday and there’s no IT desk to call. Someone leaves the company and every session they ever opened needs to be dead, not eventually expired. Rexfin’s team settings are built around those specific, unglamorous moments.

Why this is worth a dedicated feature

Most of what a finance team needs from account management isn’t complicated. It’s fast, and it’s self-serve. A workflow that requires emailing support to add a colleague, or waiting on an SMTP-based password reset that lands in spam, turns a thirty-second task into a half-day one. For a lean team, that friction shows up constantly, not just at onboarding.

What’s actually there

Under Settings, a Team section shows everyone on the workspace, name, email, when they joined, alongside any pending invites. Invites are copyable links with a visible expiry, and any member can create one or revoke one that’s no longer needed. There’s no separate admin role gating this: on a small team, the assumption is that anyone already in the workspace is trusted to bring someone else in or cut off an invite that’s gone stale.

A Sessions section gives you two things: a live count of active devices signed into the workspace, and a “sign out everywhere” action that kills every session, including the one you’re using right now, and drops you back to the login screen. That’s the button for the moment someone’s laptop goes missing, or you just want a clean slate.

Password reset is the part worth explaining, because it’s designed to work without an email server. Instead of Rexfin sending a reset email, a teammate mints a single-use reset link for a colleague directly from the settings page and hands it over however makes sense, Slack, a text, in person. That link is bound, on the server, to the specific person it was created for and to the workspace it belongs to. It cannot be repurposed to reset someone else’s password just because you have the link. It expires in 24 hours, and using it sets the new password and signs that person out of every other session they had open, so an old, possibly compromised session doesn’t linger.

Profile details and a standard password-change flow round out the Account section: changing your own password requires your current one, and doing so signs out your other sessions the same way a global reset does.

What’s deliberately not here yet

This is scoped for a small team without a need for formal role separation, and it’s honest about that boundary rather than papering over it. There’s no granular role system yet: any member can invite, revoke, or mint a reset link for anyone else on the workspace. There’s no email verification step, no self-serve account deletion, and no support for belonging to more than one workspace at a time. If your organization needs finer control over who can take which actions, that’s a separate concern covered in role-based access control, and it’s worth reading if “any member can do anything” is a bigger tent than your team wants.

Who this is for

This fits a small, trusted finance team, the kind where two to five people are actually looking at the same numbers and don’t need a formal approval chain just to add a new analyst. It’s the layer underneath everything else in the Rexfin product tour: the comments and review workflow and the insights feed both assume a workspace with real people in it, and getting people in and out of that workspace without friction is what this handles. When you’re ready to bring in someone outside the team entirely, an auditor or a board member who shouldn’t have a login at all, that’s a different door, covered in auditor share links.