Roles and permissions

Who can see and change what in AcquisitionSuite.

Who can manage the plugin

All admin screens, and all actions such as deleting leads, uploading files and saving settings, require the WordPress manage_options capability. By default that means Administrators. Editors, authors and other roles do not see the AcquisitionSuite menu.

What visitors can do

Anyone can submit a public form. They never see leads, other visitors’ data or file locations, and they can only download a file with a valid, unexpired link that was created for their submission.

Giving someone access

• Create an Administrator account for them. This gives full control of the site, so only do it for trusted people.
• Or use a role-editor plugin to grant manage_options to a custom role, understanding that this capability also opens WordPress settings.

Sharing data without access

To let a colleague see leads without admin rights, export a CSV or Excel file and share it securely. See Exporting data. With Pro you can also push leads to another system automatically using a webhook.

Agencies and client sites

Agency plans license the plugin on several sites. Each site has its own administrators and its own data; nothing is shared between sites.

Security notes

• Every admin action is protected by a nonce and a capability check.
• Payment and API keys are stored in your database and shown only to administrators; use HTTPS on your admin.