I have a manager who I've given pretty much carte blanche access to Square...but not quite. I have no intention of giving anyone "Full Access" other than myself, but this employee is pretty close with their custom permissions.
We use contracts when sending invoices and they have been sending contracts for me for the past 9 months.
We have recently started using Projects for our wedding clients (helps us to easily track where folks are in the process of planning as well as giving them a centralized location to see all of their relevant financial docs with us) and I activated the "access to projects" permission for this manager.
We kept receiving error after error and I contacted Square support. This employee sent me a video of the error, documented and completed all of the troubleshooting steps support asked her to go through. They said they would escalate and report back. I checked in multiple times via email, and nothing.
This past Monday, I refused to receive an email update (since 4 weeks had past since the last time and there were no positive updates) and spent 5 hours (!!!!!!!) on the phone being passed from department to department to department. Finally they said they escalated to engineering and I would hear back from email. Well, I know engineers don't get on the phone, so I acquiesced and said I would wait.
I received an email from the engineer yesterday who told me "everything was functioning as it should" and staff without Full Access permissions can't share projects with customers because it's sending information to a third party.
...so is sending contracts. In fact, when you enable the projects permission, there is a note underneath that says that the employee will also have access to contracts.
Why an employee without full access can send a contract that would (hopefully) be legally binding in some respect and can't share a link that would give a customer access to a centralized location with documents they already have received does not make any sense to me.
Are there other functional inconsistencies you've experienced with Square? I feel like sometimes the folks who set the rules don't understand the use case of why or how Sellers use products and highlighting them should help product managers and engineers improve user experience.
Oh! Forgot to add the pain point: my staff shouldn't need Full Access to Square in order to send a link to customers who already have all of the information contained in the project. If the limitation is solely sending info to a third party and they can already do that through contracts, then that's fine, no? We, as the owners, are giving them permission to do so.
The impact on my business: I chat with my clients and create an estimate. If there are changes that need to made before accepting, my manager handles and makes those changes on the invoice. Once the estimate is accepted, my manager converts it to an invoice. Once the deposit is paid, my manager applies the payment. This is when I would want my manager to be able to share the project link with the client because they have just signalled that they are keen to move forward by submitting a payment. We then go into our CRM and start an automation for the client where they will receive automated emails that helps us to gather further information - which my manager also does. When my client makes their final payment, my manager applies the payment.
By requiring me to go in and share contracts, I now need my manager to track who has paid their deposits, send that list to me so that I can go in and share their projects, and then they can continue on with the rest of the steps - but only after I have shared the project.
The whole reason I hired a manager is because I do not have the time for these administrative tasks. It's also such an interruption to my manager's workflow to have to wait on me (sometimes days!) to continue doing their job.
@tranguyen (I know you're still away) and @LeahK: not sure if you can get any clarification on this issue from your side. My response to their email reinforcing that everything is functioning as it should (even though they confirmed this capabilities existed recently). I really think it's important that these questions get answered. It's almost as if product teams forget that there are actual users on the other end of their decision making.
Folks rant and rave on here about changes being made without the end users being considered because there are multiple examples of that happening and then we wait years for a fix or we go through the hassle of trying to figure out something to replace the capability we lost.
My response I'd love to ensure gets to the product manager responsible for permissions/invoices/contracts/projects:
Letโs be completely transparent about what Square is actually saying here:
You are claiming it is "intentional design" for an employee to have the power to permanently DELETE my company's project data (without me receiving a notification), but NOT have the power to email a link to information the client already has access to.
To justify this, you claim that emailing a project link to a customer is a "security risk." Yet, under these exact same permissions, that same employee can freely email a binding contract to a third party.
When presented with this obvious flaw, your official stance is that because fixing your broken logic doesn't affect enough sellers, Square's recommended solution is for me to compromise my business's internal safety by granting an employee full access; exposing my company's bank accounts, tax documents, and payout settings.
That is not a "workflow inconvenience." It is a fundamental failure in basic permission architecture, a breakdown in logic, and a massive safety risk that Square is forcing onto my business.
What real-world business owner did Square consult who said, "I want my staff to be able to destroy my project files and send binding contracts, but emailing a project link is where I draw the line"?
Taking away a capability that worked previously and offering a workaround that compromises financial security is unacceptable. Before you close this ticket, I need you to answer the following questions for my records:
What is the rationale that justifies emailing a project link as a higher security risk than letting an employee permanently DELETE the entire project with zero restriction?
If sharing a binding contract and sharing a project link only "appear similar from a workflow perspective," what is the actual difference that requires a staff member to have full access to sensitive company financial data?
Why was this capability silently removed in a recent update after working previously? Based on what real-world use cases did Square determine that sending a contract and deleting a project are fine, but sending a project link is a greater issue?
What group of actual sellers did Square consult when making this change? Or was this decided by engineers who do not run a business on a day-to-day basis?
How do I escalate this directly to the Product Manager responsible for Team Permissions, so an actual decision-maker can review this safety risk?
If Square is unwilling to fix this obvious and massive safety risk in its software, I need your answers to these questions to evaluate whether Square remains a viable platform for our business.
@tranguyen - I'm going to send you a message.
The engineering team has basically told me to pound sand and wouldn't even explain *what* information is being "leaked" according to them.
This going to be the end of the road for us with Square.
I can handle a lot, but broken logic and a lack of transparency coupled with an unhindered ability to do whatever you want to thwart the processes I've implemented for my business despite being provided proof to counter what you "believe" is happening is where I draw the line.
