Manual

Every feature step by step, with screenshots from a running system. The interface in the images runs in English — that is the base language of the product.

The screenshots are from version 1.3.1. Nothing on the screens shown changed up to version 1.13.3. The only thing that looks different is the version number at the bottom of the sidebar.

Customization & administration

Here you manage the language settings of the system and apply your company’s branding. You set the date and time format, and you inform everyone about planned maintenance and outages. This block also covers the tasks you rarely do and then really need: an update, an archive, a warning before the disk fills up. Everything here is part of Basic, except sending the notice by e-mail.

1

Enable languages and translate them yourself

Under “Settings → Language Settings” you choose which languages your company offers. There are 30 to pick from.

English is always on and cannot be switched off. It is the language the system falls back to when a text has no translation yet.

After that every user picks the language they work in, from the ones you enabled, in their own menu.

Translations do not arrive with an update. An update brings new English texts; you supply the translation for them yourself.

That works in two steps. With “Export JSON” you download a file that holds every English text next to your existing translation.

You fill that file in at your own pace and load it back with “Import JSON”. Empty fields are skipped, existing translations are overwritten.

Placeholders such as {count} have to survive in the translation. An entry whose placeholders differ from the English text is rejected, and that includes an extra placeholder. The previous translation then stays active. English only appears if there was none. The system tells you which entry it was.

The card “State of your language packs” tells you, per language, where you stand. Every language you enabled appears there, even without a translation. The card shows how many texts are translated and names four cases: out of date, not translated, unknown and complete. “Unknown” means the texts were imported before this check existed. The next import settles it.

“Out of date” is the case that matters. The English text changed, your translation is still there and now says something different.

Ready-made language packs for every language are free on our “Downloads” page. You load them in with “Import JSON”, just like your own file. You can also edit the file first to improve a translation.

In the application, the “Download language packs” link on the “Import translations” card takes you straight to that page.

The “Languages” card with the languages as buttons, English switched on for good.
The red frame sits on German and on “Save languages”. English carries the mark “Always active”.Open image at full size
The “Export translations” card with the target language picker.
Pick the target language first, then download. The file holds the English text and your existing translation.Open image at full size
The “Import translations” card with the chosen file.
After “Select file” the file name appears beside it. Only “Import JSON” loads it in.Open image at full size
The “State of your language packs” card with the state of German.
In this example world the German pack is complete. The second number grows with every update that brings new texts.Open image at full size
2

Logo, favicon and colours

Under “Settings → CI Settings” you set your logo, your favicon and three colours.

The logo appears in the sidebar below the system logo. Recommended are 400 by 160 pixels as PNG or SVG with a transparent background, 2 MB at most. An SVG file that contains a script is rejected on upload. If an upload fails, the message names the reason.

The favicon is the small image in the browser tab. Recommended are SVG or 64 by 64 pixels.

The three colours are “Primary color”, “Accent color” and “Background color”. The first paints the important buttons, the second icons and highlights, the third the background.

The system works out the text and hover colours itself so the text stays readable. You only supply the three base colours.

An empty field means the built-in colour applies. The square beside it then shows black, because it cannot show “no colour”. The note below says so.

The preview below the fields shows your colours before you save. Only “Save” makes them apply for everyone.

“Restore defaults” puts everything back. That also removes the uploaded logo and favicon.

The “Colors” card with two colours set and the preview below.
The red frame sits on the two preview buttons. They show the colours you entered right away.Open image at full size
The company logo in the sidebar, below the system logo.
The red frame sits on the uploaded logo. It appears at once and on every page.Open image at full size
3

Light and dark, and the view on a phone

The system comes in a dark and a light look. You switch in your own menu at the bottom of the sidebar.

The choice belongs to each user and is remembered. One agent can work in light while a colleague works in dark.

The same menu holds your availability, your profile picture, your password and your language.

On a narrow screen the interface rearranges itself. The table turns into stacked cards, and the sidebar folds behind the icon in the top left.

There is no separate app. The address is the same as on the desktop, and you sign in the same way.

The personal menu with the entries “Light mode” and “Dark mode”.
The red frame sits on “Light mode”. The tick beside it shows which look is active.Open image at full size
The ticket list in the light look.
The light look is the factory setting.Open image at full size
The same ticket list in the dark look.
The same page, the same data. Only the look changes.Open image at full size
The same page in a narrow window, as on a phone.
On a phone the list is stacked. You open the sidebar with the icon in the top left.Open image at full size
4

Dates and times the way you write them

Before you start: Administrators and agents may change the general settings. Everyone else reads dates the way they are set there.

Under “Settings → General Settings” you find the card “Date and time format”. It sits directly behind the time zone.

Four choices make up the way a date is written. “Date order” is the order of day, month and year.

“Date separator” is the character between the numbers. You can pick the dot, the slash or the hyphen.

“Clock” is the clock: 24 hours, or 12 hours with AM and PM. “Time separator” is the character between hour and minute.

Below the four fields you see “This is how it looks”. It shows the result before you click “Save”.

The setting applies to the whole installation. It does not depend on the language, and not on the individual user.

That is deliberate. One company writes dates one way, and every colleague reads the same way of writing.

The factory setting is day, month, year with a dot and the 24-hour clock. If you change nothing, nothing changes.

The chosen way of writing applies everywhere the system shows a date. That includes the ticket, the lists, the follow-up and the logged time.

Exports are not affected. They write a date as 2026-08-22, because spreadsheet programs read that form reliably.

Fields where you enter a date follow the setting as well. A click on the field opens a calendar, and the chosen date then appears in your way of writing. An empty field reads “Pick a date”.

More on this in the card: Enable languages and translate them yourself

The “Date and time format” card with the four pickers and the preview.
The red frame sits on the order and on the preview. The examples inside the pickers move along with the chosen order.Open image at full size
The ticket details in the factory setting: day, month, year and the 24-hour clock.
This is a ticket as long as nothing is changed. At the top there are moments in time, at the bottom the days of the logged time.Open image at full size
The same details after switching to month, day, year with the 12-hour clock.
The same ticket after the change. The logged days follow the setting just as the moments above them do.Open image at full size
5

Announce maintenance and outages

Before you start: The notice on the sign-in page is part of Basic. Sending it as an e-mail as well is part of Professional.

The page “Maintenance and incident notices” sits in the sidebar. There you write a notice that everyone sees.

The notice appears on the sign-in page and throughout the system. So people read it before they even sign in.

The point is to avoid unnecessary tickets. Someone who reads that the network is down does not report it again.

You compose the text by clicking. First click the field you want to fill. It gets a red border, and everything you tick afterwards goes in there. Untick a building block and it leaves the text again.

“Title / Subject” shows at the top of the notice. “Body” shows below it. If you send the notice as an e-mail, one becomes the subject and the other the body.

Ready-made sentences are there as building blocks. You can add your own under “Text Modules” and your systems and services under “Systems / Services”.

With “Calendar (add date)” and “Time (add time)” you insert a date and a time. That is the way to announce planned maintenance.

The switch “Turn notification on/off” at the top turns the notice on and off again. Switching it on saves the title and the text along with it. The notice stays up until you switch it off. If the notice is already on, a change to the text only takes effect with “Save”.

There is a second kind of notice beside it. If you turn a ticket into an outage, it also appears on the sign-in page and disappears by itself once the ticket is resolved. This switch does not apply to it.

With “Send as E-Mail” you also send the same text to a list of addresses. That is the part which belongs to Professional.

You write the notice in English. Its translation comes in through the language page like every other text. If you change the English text afterwards, the imported translation no longer applies. It has to be imported again.

More on this in the card: The incident as a banner and as a note in the automatic reply

The card with the text modules and your own systems.
The red frames sit on the two input lines: one for sentences, one for your own systems. In this example world the systems are e-mail, a file server and VPN.Open image at full size
Title and body with ticked building blocks, the “Body” field is active.
The red frame sits on the active field and on “Calendar (add date)”. Below the field it says which one is active.Open image at full size
The sign-in page with the notice switched on, across the page.
This is how a customer reads it before signing in. “Dismiss” hides the notices currently shown until the page is reloaded.Open image at full size
The same text with “Send as E-Mail” ticked and the recipient list.
The red frame sits on the recipient list and on “Send Mail”. Separate several addresses with a comma.Open image at full size
6

Early warning before the disk fills up

The system watches the disk space on the server and speaks up before it runs out.

There are two stages. From 90 percent used you get a notice, from 95 percent a warning.

Whoever manages updates sees the figures and what to do. Usually old images from earlier updates are the biggest item.

Everyone else who is signed in gets a short sentence and a pointer to their administrator. They only see it from the warning stage.

Nothing of this appears on the sign-in page. How full a server disk is, is nobody’s business before they sign in.

A full disk does not only hit the update. Attachments, incoming mail, the database and the backup all live on the same disk.

You also get a notice as soon as less than 10 GB are free. An update needs that much space and does not start with less.

After each successful update the system removes the images of older versions. The version before stays for a rollback.

The banner with the notice that space is getting tight.
The first stage. In this example world 93 percent are used and 14 of 200 GB are free.Open image at full size
The same banner with the wording of the warning stage.
The second stage at 96 percent. Now the text also names what can start failing.Open image at full size
The same event in an agent’s window: a short sentence without figures.
People who cannot free up space get no figures. The sentence names the consequence and points to the administrator.Open image at full size
7

Update at the press of a button

Under “Settings → Updates” you see which version is running and whether a newer one exists.

If there is a new version, what it brings is listed below. The list shows every version you skip.

Before the update the system checks that there is enough free space. An update needs the old and the new image at the same time, so it asks for 10 GB. If there is not enough, the system refuses the update and says why. That is better news than giving up halfway through.

Then it takes an encrypted backup by itself. It covers the database, the attachments, the archives and the keys. If the database runs outside SMITEY, it is not part of this backup.

If the backup fails, the update stops before anything is changed. A database outside SMITEY does not hold the update up. Back it up with your own tools.

The system asks before it starts. During the update it is unreachable for a few minutes, so pick a quiet time.

If something goes wrong, the system falls back to the previous version and keeps running.

If your server cannot reach the update source, the system says exactly that. It does not then claim you are up to date.

An update that moves the database to a new version is not applied at the press of a button. The system tells you, and the release notes say what to do.

The “Version status” card reporting that the system is up to date.
The red frame sits on the message. “Check now” asks straight away instead of waiting for the next check.Open image at full size
The same card with a version available and its release notes.
The red frame sits on “Install update”. Above it stands what the new version brings.Open image at full size
The confirmation asked before the update starts.
The question names the version and says that a backup is taken first.Open image at full size
The same card when the update source cannot be reached.
The red frame sits on the message. Without an answer the system says that it does not know.Open image at full size
8

Archive closed tickets

Before you start: “Delete from live DB” removes the tickets from the running database for good. Download the archive first and look inside.

Under “Settings → Archive” you pack the closed tickets of a period into a file. That keeps the working set small.

Only closed tickets move. A resolved ticket only joins once it is closed. That happens by itself 24 hours after it was resolved. An open ticket in the same period stays where it is.

“Preview” tells you up front how many tickets the period covers. It writes nothing and changes nothing.

“Create archive” builds a ZIP file. It holds the tickets with their comments, their history, their custom fields and their attachments.

The file then sits in the list below, with period, count and size. A subfolder is possible if you want to file by year.

Only then do you decide whether the tickets leave the running database. That is a step of its own: “Delete from live DB” in the “Existing archives” list. Creating the archive on its own changes nothing.

“Restore” brings the tickets back from the file. Tickets whose number already exists are skipped.

A restore needs the teams and the workflows a ticket refers to. Afterwards the system reports how many tickets came back and how many it skipped because they already existed. It also names skipped team participations and tasks without their child ticket. Other gaps are not reported. A missing team, category, user or status is left empty on the ticket. Comments without their user and values of deleted custom fields are left out.

“Delete archive file” only deletes the file. The tickets in the running database are untouched.

The “Create archive” card with the two date fields.
The red frame sits on the period. The subfolder is optional.Open image at full size
The same card with the result of the preview.
The red frame sits on “Preview”. The number next to it counts the closed tickets of the chosen period. The preview changes nothing.Open image at full size
The list of archives with period, count, attachments and size.
The red frame sits on the two actions that touch the running data.Open image at full size
The question asked before the tickets leave the running database.
The question says that this step cannot be undone.Open image at full size
9

Fill your drop-down lists from a file

Under “Settings → General Settings” you find the system’s drop-down lists. Each list has its own tab.

For departments, positions and sites there is also the route through a file. That pays off when you add many entries at once.

“Export JSON” downloads the list. On a fresh installation this gives you the empty structure to write your entries into.

The file holds an example that shows what an entry looks like. It is skipped when you load the file back.

“Import JSON” creates what is missing. Existing entries are left alone. A name that appears twice in the file is created once.

Renaming does not work through the file. The fields on this page are there for that, and the red note says so. The placeholder “None selected or available” cannot be renamed. You only translate it, on the language page.

You translate the entries afterwards on the language page. The file holds the English name.

Categories work the same way. They belong to a team, so they live on that team’s category page.

More on this in the card: Main and sub categories are freely configurable per team

The “Department” tab with the export and import buttons.
The red frame sits on the two buttons. The red sentence above warns against renaming through the file.Open image at full size
The downloaded file in the browser, with the example and the entries.
Apart from a short header and the example, the file holds only names. That is why any text editor can edit it.Open image at full size

Teams & users

A team is a responsibility, not a folder. It has its own categories, its own deadlines and its own members. A customer sees exactly one of them. Everything else comes down to who has which account and what that account may do.

1

Create and configure teams

Teams live under “Settings → Teams”. The list is on the left, the settings of the team you clicked are on the right. The number behind the name is the number of its members.

A new team gets its name in the “Team name” field. Below it, “Copy categories from” lets you pick an existing team, so the new team starts with the same main and sub categories. “Create team” creates it.

The first team is the team your customers see. Every further team is a specialist team behind it. Asking a reporter to pick the right department themselves is asking too much: they file with the first team, and it is handed on from there.

You can change that at any time. The “Customer permissions” card decides per team what customers may do there. It has two switches: “Can create new tickets and see their own tickets” and “Can see their own tickets of this team in the dashboard and in reports”. As soon as one of them is on, customers see the team. Only with both off does the team not show up for a customer at all.

The “Agent Permissions” card applies to the agents of this team. It has three switches: managing tickets, managing categories and seeing this team’s reports. Without the first, an agent can neither create, edit nor comment on tickets in this team, nor upload attachments. Without the second, the entry for the team’s categories disappears from their sidebar. Without the third, the reports leave this team out. Every change is recorded in the team’s “Audit log”.

The “Agents” card holds the members. Despite the heading, the team’s customers are in there as well. The picker above it and “Add Agent” add someone, “Remove” takes them out. Whoever is added or removed has to sign out and back in once.

“Default e-mail language” is the language this team writes in. It applies when a mail rule selects “Team default language”.

The “Active” switch takes a team out of service. It disappears from the sidebar and from every picker. It is not deleted by that.

“Delete” only removes a team while no ticket is still open. Otherwise the system names the reason and does nothing.

The “Audit log” card records every change to the team, with name and time.

Basic runs one team. Professional has no limit.

The “Teams” page with the list of both teams on the left and the Helpdesk settings on the right.
The red frames sit on the two teams. Clicking one changes what stands on the right. The number at the edge is the member count.Open image at full size
The “Team name” field with a name typed in, below it “Copy categories from” and the “Create team” button.
Type the name, optionally take over the categories of an existing team, then “Create team”.Open image at full size
The “Customer permissions” and “Agent Permissions” cards with their switches.
The red frames sit on the two headings. These switches apply to this one team only.Open image at full size
The “Agents” card with the picker, the “Add Agent” button and the members below.
The red frame sits on “Add Agent”. The badge next to each name is the role, and the card holds the team’s customers as well.Open image at full size
The “Audit log” card with its entries, each with the change, the name and the time.
The red frame sits on the heading. Every line names the change, who made it and when.Open image at full size
2

Create administrators and agents

Accounts live under “User management”. The list shows name and sign-in name, the e-mail address, the team with the department below it, and the role.

“New user” opens the form. First name, last name, sign-in name and e-mail address are required. On top of that comes a password. With Professional you can set the “Send login details by e-mail” tick instead.

With that tick you set no password. The new user gets a mail with their sign-in name and a time-limited link and sets their own password. The system never sends passwords.

The role decides everything else. “Admin” and “Agent” are both staff and count against the same pool. An administrator may do more out of the box. Nearly every single permission can be changed; the exceptions are on the card “Roles and the permission concept”. Only an administrator can give or take away the “Admin” role. That also applies to their own account. “Edit user” only changes the team shown in the form. Teams the person was added to with “Add Agent” stay as they are.

Basic comes with two staff seats. How you split them is up to you: one administrator and one agent, or two administrators. Customers do not count, they are unlimited in both editions.

When someone leaves, click the archive symbol in their row. The account is locked, so they can no longer sign in.

A locked account moves to the “Archived” view and carries the “locked” badge there. It is no longer visible in the “Active” view.

A locked account no longer occupies a staff seat, and it appears in no “Assign to” picker. Tickets already assigned keep their agent and their agent’s name.

In the “Archived” view the same button is called “Restore” and releases the account again. In Basic that needs a free seat again.

The key symbol resets a password. The crossed-out shield resets two-factor sign-in. The new password is then shown once on screen. It is not sent anywhere.

Resetting the password or two-factor sign-in only lifts the short lock after failed attempts. An archived account stays locked. It receives no invitation and no reset mail, and only “Restore” brings it back.

Archiving can be undone at any time. If someone has left for good, also delete the account with the bin symbol “Delete account”. Only from the deletion on does the time until automatic anonymization run.

More on this in the card: Anonymize people

The “User management” page with all accounts, their role and the actions in each row.
The red frames sit on “New user” and on the switch between open and locked accounts. The button shows which of the two views is open.Open image at full size
The “Create new user” dialog with names, user name and e-mail filled in, and the pickers for team, department, position, location and role.
The red frames sit on the role and on the invitation. The role is the only picker that has to be filled in.Open image at full size
The same dialog with the tick set: the password field is disabled and says the user sets it via the link.
With the tick the asterisk on the password field disappears. The field itself says who sets the password.Open image at full size
The “Archived” view with a locked account, the “locked” badge and the restore icon at the end of the row.
The red frames sit on the badge and on the way back. Both exist only in this view.Open image at full size
3

Customers: the accounts of the people who report

Customers are unlimited in Basic and in Professional. They occupy no staff seat.

A customer account comes about in three ways. You create it yourself under “User management”; with Professional you can invite the person by mail while doing so. The second way is self-registration. The third is the first sign-in through SSO or a directory, which creates the account by itself.

The switch for that sits under “Settings → Security” in the “Self-registration” card. It is off out of the box. Switched on, a “Register” link appears on the sign-in page.

Whoever registers themselves always gets the “Customer” role. No other role can be handed out along this route.

With Professional, a self-registered customer gets a second mail after the welcome. With the link in it, they confirm their address. Until then, their account carries the “not confirmed” note in the list.

You can also confirm an address yourself. In Basic that is the only way, because Basic sends no mail. The account’s row then shows a button with an envelope icon: “Mark email as confirmed”. Only do that if you know that the address belongs to the person.

For an internal helpdesk you are better off leaving the switch alone. Otherwise anyone who knows the address creates an account.

A customer sees only their own cases. These are the tickets they created themselves. Added to that are the tickets that an agent or an email created for their confirmed address. A ticket that another customer creates with their address stays hidden from them. If two accounts have the same address, both see these tickets.

If their address is not confirmed yet, a notice sits above their ticket list. With “Send confirmation email” they request the link again. The notice only appears if the system can send mail.

Their sidebar is short: their tickets, a new ticket, the knowledge base. They never get to see any settings. If the team’s switch “Can see their own tickets of this team in the dashboard and in reports” is on, their sidebar also holds the dashboard and the reports.

What they may do in a team is set on the team. Only with both customer switches off does that team not exist for them.

The “Self-registration” card with the switch and the note below it.
The red frame sits on the switch. The text beside it says what it does and what happens without mail delivery.Open image at full size
The same system, signed in as a customer: a short sidebar and a ticket list holding only her own cases.
The “User” column holds the same name in every row. A customer sees nothing that is not theirs, and the settings are missing from the sidebar.Open image at full size
4

Data export for one person

Before you start: You need the “Data export (data subject request)” permission. As the factory setting, only administrators have it.

A person can ask you which data you store about them. The data export collects all of it in one ZIP file.

You start it under “User management”. Every row has a file symbol with an arrow and the tooltip “Export personal data”. It opens the export for that account.

Some people have no account. They only wrote to you, or an agent created a ticket with their address. For them there is “Export by e-mail address” at the top of the page. Type the address there and click “Search”. The search works with an account or an address, never with a name.

A search by address finds less than a search by the account. It only finds where the address itself is stored, for example as the requester of a ticket or as the sender of an e-mail. A search by the account also finds everything that is linked to the account. If the address belongs to an account, the dialog says so and offers “Use this account”. After that, it shows the person’s name and the account’s e-mail address.

Before you download anything, the dialog shows what it found, counted per area. Areas are for example tickets, time entries, satisfaction surveys and the security log. If it finds nothing, it says “No data found for this person.” and offers no download. If the address belongs to an account and has no findings of its own, the dialog shows no findings and offers no download. It shows the box with “Use this account”. Administrators also see the “Anonymize” area below it. The card “Anonymize people” explains it.

“Download” creates the ZIP file. It holds one JSON file per area, so the data can be read by machine. The files of all attachments found come with it. “overview.html” shows the main content in a readable form. There, every ticket says why it is included (“Why this ticket is included”). “README.txt” is written for the person and explains what the file contains.

A ticket that concerns the person comes along in full. That includes comments and changes by other people. Internal notes are included as well and are marked as internal. If the person replied by e-mail to someone else’s ticket, that ticket carries the badge “Replied by e-mail to someone else’s ticket”. A ticket on which the person made the last change comes along as well. Its line “Why this ticket is included” then names “Last person to change the ticket”.

So check the export before you hand it over. Black out data of other people where needed. The dialog reminds you of this. The “README.txt” does not contain this note, because it goes to the person.

Tickets that were moved to an archive are not searched. Check your archives separately. The dialog reminds you of this as well.

Passwords and two-factor keys are not part of the export.

Every download is recorded: who started it, for which person and when. The record holds no content of the export. The search before it is not recorded.

An agent who gets the permission also needs “Users: manage accounts”. Otherwise they cannot reach the “User management” page. The permission can never be given to the “Customer” role.

The area “Survey consents and unsubscribes” holds every consent and unsubscribe for the satisfaction survey with date, channel and ticket. “overview.html” shows the full history in a section of its own. If the person was anonymized after an unsubscribe, the export by their address finds the remaining unsubscribe. The column “E-mail address” then says “Anonymized (address removed)”.

More on this in the card: Anonymize people

The “User management” page with the “Export by e-mail address” button at the top and the file symbol with an arrow in every row.
The red frames sit on “Export by e-mail address” and on the symbol in Julia Becker’s row. Both open the same dialog.Open image at full size
The “Export personal data” dialog for Julia Becker with her e-mail address below the name, the list of findings per area, the two notes on checking and on archives, the “Anonymize” area and the “Download” button.
The red frames sit on the list of findings and on “Download”. The list only names areas in which something was found.Open image at full size
The same dialog after searching by address: it names the account the address belongs to and offers “Use this account”.
The red frame sits on “Use this account”. By the address alone the search finds nothing here. That is why the dialog shows no findings and no “Download”. The export for the account finds Julia Becker’s tickets. Only administrators see the “Anonymize” area below.Open image at full size
5

Anonymize people

Before you start: Only an administrator can anonymize a person. An anonymization cannot be undone.

Some data must not stay forever. When someone leaves your company, or a person asks you to delete their data, you anonymize them. Name and e-mail address are then replaced by a placeholder such as “Anonymized user 3”. The tickets stay. Reports, deadlines, time entries and satisfaction figures keep counting.

Each person gets their own number. Two entries with the same number come from the same person. The e-mail address becomes “anonymized-3@anonymized.invalid”. No mail can be delivered to such an address, so the system leaves it out when it sends mail. The placeholder is stored in English and stays English in every language.

There are two ways. The automatic way anonymizes deleted accounts after a set number of months. The immediate way anonymizes one person at once, for example after a request for erasure.

The automatic way is under “Settings → Security” in the “Data protection” card. The switch “Anonymize deleted users automatically” is off as the factory setting. Next to “after” you enter the number of months. Allowed are 1 to 120, the factory setting is 36. “Save” stores a changed number.

The time counts from the day an account was deleted. The system checks every ten minutes whether a run is due. It runs once a day, at the first check after 03:00 in the time zone under “Settings → General Settings”. Every deleted account whose time is up is anonymized in that run.

When you turn the switch on, a window opens first. It lists the deleted users the next run will anonymize, each with the day of deletion. Type ANONYMIZE into the field and click “Confirm”. Only then is the switch on. If it is already past 03:00 in that time zone, the first run follows within about ten minutes.

The same window appears when you shorten the number of months while the switch is on. Turning it off needs no confirmation.

The time only starts when an account is deleted. Archiving is not enough. An archived account is only locked and can come back at any time, for example after parental leave. To delete an account, click the bin symbol “Delete account” in its row under “User management”.

A window says what follows before anything happens. If automatic anonymization is on, it names the number of months. A deleted account appears in the “Archived” view with the “Deleted” badge. The symbol “Restore account” brings it back. For administrators and agents, Basic needs a free seat for that. If the account is deleted again later, the time starts again.

Your own account has no bin symbol. Only an administrator can delete or archive an administrator account. The last active administrator can be neither deleted nor archived.

So when someone has left for good, delete the account and do not only archive it. An account that has been archived for more than a year shows a calendar symbol in its row. Its tooltip reminds you to delete the account.

The immediate way is in the data export dialog, in the “Anonymize” area below the findings. You open the dialog from the row of an account, or with “Export by e-mail address” for a person without an account.

If the address belongs to an account, click “Use this account” first. Only then is the account itself anonymized. A run by the address alone replaces the address where it is stored and leaves the account as it is.

Type ANONYMIZE into the field and click “Anonymize”. An active account is deleted first and then anonymized. Your own account cannot be anonymized. Neither can the last active administrator.

Afterwards the row carries the “Anonymized” badge. Such an account can no longer be edited, restored or reactivated. Only the data export remains. You may run the anonymization again. The number stays the same, and data restored since is covered as well.

The box “Also clear the content of tickets this person requested” goes further. The number in brackets is the number of those tickets. Their texts are cleared and their attachments are deleted. Tickets of other people in which the person only replied are only anonymized.

Check your retention duties first. In Germany, for example, business letters must be kept for six years. The dialog reminds you of that. The automatic way only anonymizes. It never clears content.

If a file could not be deleted from the server, the dialog says how many. The run still counts as done. The system does not try again on its own.

Every run is recorded with its time, the number of the placeholder and what was changed. For the immediate way, the record also names who started it. It holds neither the name nor the e-mail address of the person.

Anonymizing needs the “Anonymize people” permission. By default, only administrators have it. Only an administrator can use it. It can never be given to the “Customer” role. The data export dialog also needs “Data export (data subject request)”.

More on this in the card: Data export for one person, Retention periods

The “Data protection” card with the switch turned off, the field for the months, “Save” and the “Download list of anonymizations” link.
The red frames sit on the switch and on the number of months. The switch is off, as after every update.Open image at full size
The “Who will be anonymized” window with one deleted user and the date of deletion, below it the field with ANONYMIZE and the “Confirm” button.
The red frames sit on the list and on “Confirm”. Oliver Grant was deleted more than 36 months ago. The first run would anonymize him.Open image at full size
The “Delete account” window for Amir Khan. The text names what follows and the 36 months until the anonymization.
The red frame sits on “Delete account”. Automatic anonymization is turned on here. That is why the window names the number of months.Open image at full size
The “Archived” view with Oliver Grant’s deleted account, the “Deleted” badge and the symbol for restoring it.
The red frames sit on the “Deleted” badge and on “Restore account”. Until the anonymization the account can be brought back.Open image at full size
The “Export personal data” dialog for Tomas Novak. Below the findings sits the “Anonymize” area with the ticked box, ANONYMIZE typed in and the “Anonymize” button.
The red frames sit on the box and on “Anonymize”. Tomas Novak requested four tickets. Their content would be cleared as well.Open image at full size
The “Anonymize” area after the run: at the top “Already anonymized as Anonymized user 2”, at the bottom the “Done” message.
The red frame sits on the message with the number of the placeholder. The area allows another run.Open image at full size
The “Archived” view with anonymized accounts. Every row carries a placeholder name, the placeholder address and the “Anonymized” badge.
The red frame sits on the “Anonymized” badge. An anonymized account has no action left except the data export.Open image at full size

The account

The following tables name every place where the system stores a person, and what the anonymization does there. You can use them to describe how your company deletes personal data.

DataWhat happens
First name and last name“Anonymized user” and the number
E-mail address and sign-in namethe placeholder address
Phone numberremoved
Department, position and locationremoved
Language, light or dark look, availabilityback to the factory setting
Password and the list of earlier passwordsdeleted
Two-factor keys and the link to an account at a sign-in provider (SSO)deleted
Sign-in events in the security logdeleted. The person’s administrator actions in the security log stay. Their name there is replaced by the placeholder.
Profile picturedeleted
Role and team membershipsremoved. The user list then shows the role “Customer”.
Own column choice of the ticket listremoved
A running time tracking timerdeleted
The account itselfstays, deleted and locked for good. Tickets, comments and time entries keep pointing to it. That is why reports keep counting.
Yes/no flags for confirmed e-mail address, confirmed phone number and two-factor sign-in, the yes/no setting of the ticket list, the counter of failed attempts, the time of the last password change and of the deactivationstay. They hold no value of the person, only yes or no, numbers and times. The address, number, password and keys themselves are replaced or deleted.
The note on a ticket of who last changed itremoved. The ticket then names nobody as the last person to change it.

Copies of the name

In some places the system stores the name a second time. That way an entry still shows who made it after a change. These copies are replaced as well.

PlaceWhat happens
Who made a change in the ticket historyplaceholder name
Name on time entriesplaceholder name
Who changed a knowledge base articleplaceholder name
Entries in a team’s “Audit log”, also “Added user …” and “Removed user …”placeholder name
Requester name on tickets the person requestedplaceholder name. The requester’s phone number is removed.
Old and new values in the ticket history: requester name, address and phone number, observers, assignmentplaceholder or removed. This applies in the person’s tickets and in tickets in which the person was the requester before.

E-mail addresses

Wherever an address of the person is stored as a field of its own, it becomes the placeholder address. Upper and lower case do not matter.

PlaceWhat happens
Requester address on ticketsplaceholder address
Recipient of satisfaction surveysplaceholder address
Address of an approver, on approvals and in requests with tasksplaceholder address
Sender of incoming e-mailsplaceholder address
Fixed recipient address in reply templatesplaceholder address
Internal note that a mail rule has already handled an e-mailplaceholder address
Address in the record of earlier data exportsplaceholder address. The record itself stays as proof. A later data export for this address also records only the placeholder.
Suggestions for the requester details when a ticket is createddeleted where they carry the address
Entry on the e-mail blockliststays. Otherwise spam from this address would get through again after the deletion.
Consents and unsubscribes for the satisfaction surveydeleted. If the last entry was an unsubscribe, it stays as one entry without the address. The list “Survey consents and unsubscribes” shows it as “anonymized”. Until the person gives consent again or subscribes again, no survey goes to the address. If the anonymization key can no longer be read or was discarded, this entry no longer takes effect.

Addresses in text

In texts, the anonymization only replaces the person’s e-mail addresses. This happens in the tickets that concern the person. These are the same tickets the data export finds.

TextWhat happens
Ticket descriptionaddresses replaced
Comments, including the text of incoming e-mailsaddresses replaced
Subject of incoming e-mailsaddresses replaced
Notes on time entriesaddresses replaced
Comment in a satisfaction surveyaddresses replaced
Old and new values in the ticket historyaddresses replaced
Title and text of knowledge base articles, also in their historyaddresses replaced, in all articles

Clearing the content of requested tickets

With the box “Also clear the content of tickets this person requested”, these tickets lose their content. What reports and deadlines need stays.

Part of the ticketWhat happens
Number, dates, status, team, category, priority, assignment and deadlinesstay
Titlebecomes “Content removed”
Descriptioncleared
All comments, also the replies of agentstext cleared. The comment itself stays, so the first response and the deadlines stay correct.
Subject of incoming e-mailscleared
Values of custom fieldsdeleted
Follow-up note and locationcleared
Ticket historyThe kind of each change stays. The values are cleared, except for status, priority, category, subcategory, channel, team, escalation and assignment. Reports need those.
Satisfaction surveyThe rating stays, the comment is cleared.
Time entriesThe booked minutes stay, the note is cleared.
Attachmentsdeleted, the entry and the file

Limits

Names in running text stay, for example “Regards, Max” at the end of a mail. Phone numbers in running text stay as well. Neither can be recognized reliably. For a customer’s tickets there is the box for clearing the content.

If another account has the same first and last name, the person’s name is not replaced in the ticket history or as the requester name. Otherwise the entries of the other person would be hit too. Address and phone number are still replaced. The check compares first and last name. The assignment history stores the sign-in name. A namesake who appears there only with a sign-in name is therefore not detected.

Very old entries in the ticket history that do not yet point to the account only carry the name. They are not recognized.

A ticket that an agent recorded by phone without the requester’s e-mail address is not recognized. The requester’s name and phone number stay in it.

Addresses in settings are not changed, for example in mail rules and automation rules. If the person’s address appears there, change it yourself.

If the person writes again after the run, a new run by their address also covers the new e-mails. You start it with “Export by e-mail address”. The number stays the same. A new run on the anonymized account does not find the new e-mails. The account no longer knows the old address.

The system takes care of archives itself. When you restore an archive, every person anonymized before is anonymized again in the restored tickets. The message after restoring says how many. An address that appears in those tickets only in running text is not recognized there. Archive files are also updated by the nightly run after an anonymization. The card “Retention periods” explains it.

Backups are different. A backup made before a run still holds the old data. “Ticket System Backup & Restore” takes care of that when you restore. It asks whether everyone anonymized in today’s state should be anonymized again. “Yes” is preselected. The ticket system then does this in the nightly run at 03:00 in the time zone that is set. This also applies if the switch is off. Until then their names are visible again. The “Data protection” card shows a note with the number. The backup also brings back the switch setting of that time. So check the switch after restoring.

If you restore a backup some other way, answer “No”, or use “--no-reapply” on the command line, this does not happen. The automatic way then finds the deleted accounts again, as long as the switch is on. Runs you started by hand have to be repeated. The link “Download list of anonymizations” in the “Data protection” card helps with that. Download the list before you restore. Afterwards it no longer contains the runs made after the backup. The list has one row per anonymized person, with the columns “Date”, “Number”, “Account ID”, “E-mail hash” and “Content cleared”. “Date” is the time of the first run in UTC. “Account ID” is only filled if an account was anonymized. “E-mail hash” is a fingerprint of the address that cannot be reversed. “Content cleared” says whether the content of the requested tickets was cleared. After each run, download the list by hand and keep it outside the system. A backup made before a run does not contain that run.

Text for your privacy notice

As the operator, you must tell people how long you keep their data. You can use this text in your own privacy notice.

Template text

After you leave, your name and e-mail address in the ticket system are replaced by a placeholder after [36] months. Tickets and figures are kept without any reference to you. At your request, we can also anonymize your data earlier, unless a retention duty prevents this. Data of external contacts with whom there has been no contact for [36] months is anonymized in the same way. Sign-in events in the security log are deleted after [90] days. Entries about administrator actions are deleted after [12] months.

Change the numbers to your own settings. Leave out every sentence whose switch is off. Have the text checked by your own data protection adviser. This manual is not legal advice.

Deletion requests and returning people

Deleting and anonymizing are two different things. “Delete account” only hides an account. “Restore account” brings it back. Until then its e-mail address stays reserved for this account. So you fulfil a request for erasure with “Anonymize” in the data export dialog. This cannot be undone. Name and address are replaced by “Anonymized user” and the number. The link to the account at a single sign-on provider is deleted.

Each e-mail address belongs to exactly one account. If you create an account with an address that another account already holds, the system refuses. The message reads “This e-mail address already belongs to another account.” The same applies when you change the address of an account. If the address belongs to a deleted account, the message reads “This e-mail address belongs to a deleted account. Restore that account instead.” Then restore the old account instead of creating a new one. Anonymized accounts do not count. They only carry the placeholder address.

A deleted account cannot be restored if another active account now holds the same address. The message then reads “This e-mail address already belongs to another account.” First change the address of the other account.

From the time before this rule there may be accounts that share an address. The user management shows them with the note “This e-mail address belongs to more than one account. Change it so that each account has its own address.” Give each of these accounts its own address. Until then, signing in with this address instead of the user name does not work. The password reset mail is not sent either.

If a person returns after a request for erasure, they get a new account. This applies, for example, when they sign in again through Google or Microsoft with the same address. For that, “Automatically create accounts on first sign-in” must be on. The anonymized account no longer carries their address and does not stand in the way of the new account.

Old anonymizations never affect this person’s new tickets. This also applies after a backup or an archive has been restored. When an anonymization is applied again, it only covers data that was created before its time.

If the old account was only deleted and not anonymized, the system refuses the first sign-in through SSO with this address. What the person sees depends on the provider. If the provider confirms the address, the message reads “An account with this e-mail address was deleted. Ask an administrator to restore it.” If it does not, the message reads “Your e-mail address is not verified with the provider.” That way the system does not reveal whether a deleted account exists for an address.

As an administrator you then have two ways. If you restore the old account with “Restore account”, the person continues in it with their history. Sign-in through SSO works if the account was already linked to this provider or the provider confirms the address. If the request for erasure still applies, anonymize the old account. Afterwards the address is free, and the sign-in creates a new account.

Self-registration answers neutrally in this case: “Registration could not be completed. If you already have an account, use the password reset on the sign-in page.” It does not reveal whether an account exists for the address.

6

Retention periods

Before you start: Only an administrator can change these settings. An anonymization cannot be undone.

The system keeps personal data only as long as it needs it. A person is anonymized when they leave or when they ask for it. Leaving means a deleted account, or an external contact who has not been in contact for a long time. You handle a request in the data export dialog with “Anonymize”.

Tickets themselves have no time limit. Their content keeps its purpose, for example as customer history. Reports and time entries keep counting.

All time limits are under “Settings → Security” in the “Data protection” card. It has three blocks: “Deleted accounts”, “External contacts” and “Security log retention”. Each block has a switch, a time limit and “Save”. The “Security log retention” block has two switches and two time limits. Below them is “Archives”. After a restore, “Restore from a backup” is added once the next run at 03:00 has taken place. Until then the card shows the note “… will be applied again tonight at 03:00.” The card “Anonymize people” explains the first block. It also holds the template text for your privacy notice. Below the description of the “Data protection” card is the link “Data protection guide for operators”. The guide contains templates for the record of processing activities, the technical and organisational measures and a concept for retention and deletion.

Below each block there is a “Last run” line. It names the date and time of the last nightly run and how many people or entries it handled. “0 done” means there was nothing to do. “Not run yet” appears as long as the task has no result. If a switch is off, its task does not run.

If the line is orange, the task did not finish everything. With “skipped” it names how many people, entries or files were skipped. For “Archives” these are locked or damaged files. With “failed” the whole task failed. The sentence after it says what to do. If it reads “Details are in the server log.”, read the log of the server. On Linux the command “sudo podman logs container-backend-1” shows it. If it names the anonymization key, follow the section “When the key cannot be read” further down. The next nightly run tries again whatever was skipped.

More on this in the card: Anonymize people, Getting everything back

The “Data protection” card with the blocks “Deleted accounts”, “External contacts” and “Security log retention”, below them “Archives” and “Restore from a backup”, each with its “Last run” line.
The red frames sit on the “Last run” lines. All four switches are on here. By default only the two switches in the “Security log retention” block are on.Open image at full size
The “External contacts” block with the switch “Anonymize external contacts automatically” and the “Months without contact” field.
The red frames sit on the switch and on the number of months. The text below them names what counts as contact.Open image at full size
The “Who will be anonymized” window with the sentence “Nobody is due yet with this time limit.”, ANONYMIZE typed in and “Confirm”.
The red frames sit on the field and on “Confirm”. Here the time limit was shortened to 24 months, and nobody would be due. Otherwise the number and the first people with their last contact appear here.Open image at full size
The “Recent sign-in attempts” card with the sentence “Entries are deleted after 90 days (Settings → Security).” and three sign-ins.
The red frame sits on the sentence about the time limit. If the deletion is off, it reads “Entries are kept until you delete them.”Open image at full size
Two notes at the top of the card: the number of addresses that are no longer recognized, and anonymizations that could not be carried over.
The red frame sits on the note about the carry-over. What to do is in the section “Restoring a backup”.Open image at full size
The warning “The anonymization key cannot be read” with the “How to restore the key” link and the “Discard old key” button.
The red frames sit on the link to this manual and on “Discard old key”. As long as the warning is shown, the card shows no note on pending anonymizations.Open image at full size
The “Discard old key” window with DISCARD typed into the “Confirmation word” field.
The red frames sit on the field and on “Discard old key”. Only with the word can the button be clicked.Open image at full size

External contacts

External contacts are people without a staff account. These are requesters without an account and customer accounts. For the system they never leave. That is why this block counts the time since the last contact.

The last contact is the newest of these times: the last change to a ticket the person requested, an e-mail from them, their own comment, an answer to a satisfaction survey, an approval sent to them and a suggestion for the requester details. For a customer account, the day it was created counts as well. A new account that was never used is therefore not due at once. Accounts that existed before the update to version 1.7.0 count as created on the day of the update.

Staff accounts and their addresses are never affected. This also applies to a shared address such as info@ if it belongs to a staff account. Anyone with a ticket that is not closed yet is skipped until it is closed. Deleted accounts belong to the “Deleted accounts” block.

The switch “Anonymize external contacts automatically” is off as the factory setting. Next to “Months without contact” you enter the number of months. Allowed are 1 to 120, the factory setting is 36.

When you turn the switch on, the “Who will be anonymized” window opens first. It says how many people are due and shows the first of them with their last contact. Type ANONYMIZE into the field and click “Confirm”. The same window appears when you shorten the number while the switch is on and click “Save”.

This is applied in the next nightly run. Each due person is anonymized as with “Anonymize”. Their content is never cleared. What remains is the placeholder, the tickets and the figures. Names and phone numbers in running text stay. The card “Anonymize people” lists the limits.

Security log

The security log records sign-in events and administrator actions. Sign-in events also hold the IP address and the browser identification. The card “The security log” explains what exactly is recorded.

The “Recent sign-in attempts” card under “Settings → SSO Settings” shows the last 100 sign-in events through SSO and the directory. Anyone who may open that page can see it. By default these are only administrators. The sentence below the card title names the time limit, for example “Entries are deleted after 90 days (Settings → Security).”

By default sign-in events are deleted after 90 days and administrator actions after 12 months. In the “Security log retention” block you set 7 to 365 days next to “Days” and 1 to 120 months next to “Months”. The switches “Delete old sign-in events” and “Delete old administrator actions” turn the deletion off. The entries then stay. No confirmation word is needed, because only entries are deleted and no people.

Sign-in with a username and password is in the security log as well. A failed attempt is stored with its IP address and browser. A successful sign-in is only stored for administrators and after failed attempts.

Archives

An archive file also holds people who were anonymized only later. The nightly run after an anonymization therefore updates every archive file in which the person appears. Names and addresses are replaced there by the same placeholders as in the database. If the content was cleared, the attachments of those tickets are missing from the archive as well.

Until the next night the person is therefore still in the archives in plain text. Archives have no switch. An archive file that is locked at that moment stays unchanged, for example because it is being downloaded or restored. The same applies to a damaged file. The next nightly run tries again.

Time and time zone

All these tasks run once a day at 03:00. The time zone under “Settings → General Settings” in the “Time Zone” card applies. The clock of the server does not matter. Many servers run on UTC. There 03:00 would be a different hour for you.

The system checks every ten minutes whether the run is due. The first check after 03:00 starts it. If the server was off at 03:00, the run follows at the first check after the start.

After the update to version 1.7.0, the first run follows soon after the update, at the latest at the next 03:00. That run removes the entries of the sign-in log older than 90 days.

If you change the time zone, the new one applies from the next check. The run takes place at most once per calendar day. After a change to the west it can be left out on that day. It then follows on the next day.

The application “Ticket System Backup & Restore” plans its backups in the same time zone. It reads the zone from the ticket system when the schedule is applied. The “Schedule” tab and “schedule --show” show the time with the zone, for example “02:00 (Europe/Berlin)”. If the database cannot be reached at that moment, the previous zone stays. If there is none yet, the clock of the computer applies and the display reads “(host clock)”.

The operating system only knows its own clock. So the application converts the time. Depending on the time zone of the server, it registers one or two entries per plan. That way the backup runs at the right time in summer and in winter. On start it checks whether a backup is really due. Otherwise it ends without a backup, and the log says “No backup is due at this time in …”.

If you change the time zone in the ticket system, the next scheduled backup still runs. Afterwards the application registers the schedule again. The log then shows a warning that starts with “The time zone in the ticket system changed”. If the schedule could not be registered again, it says “The schedule could not be updated.” Then open the application and click “Apply schedule”.

When the key cannot be read

The system remembers anonymized e-mail addresses as a fingerprint. For that it needs a key. The key ring of the server protects this key. The key ring consists of the files key-*.xml in the key folder. If they are missing or do not match, the card shows the warning “The anonymization key cannot be read”.

Then saved passwords for mail and SSO do not work either. They depend on the same key ring. The nightly runs for deleted accounts and the security log go on. People who are only known by their address are skipped. “Anonymize” refuses a run by the address alone.

This is how you get the key ring back. Take a backup from before the problem. It holds the key folder as a file of its own. On Linux the backups are in “/opt/smitey/backups”. Copy one of them into an empty folder and change into that folder. The commands below write the backup as plain files and take the files key-*.xml out. Then they copy the files into the key folder and restart the server of the ticket system. Other files in the key folder stay as they are. After the restart the warning is gone. Afterwards delete the folder “plain”. It contains passwords and personal data. An older backup ending in “.zip” is not encrypted. For it the first command is “sudo unzip -o <file> volumes/dataprotection_keys.tar && sudo tar -xf volumes/dataprotection_keys.tar”.

On Windows the backups are in “C:\Program Files\SMITEY\backups”. Copy one of them into an empty folder. Open PowerShell there as an administrator. Enter the command from the box “Windows: Write the backup as unencrypted files and take the key files out”. Replace <file>.smbk in it with the full file name of the backup. Then copy each file key-*.xml with “podman cp <file> container-backend-1:/app/DataProtection-Keys/”. Enter the commands for the owner and the restart without “sudo”. Afterwards delete the folder “plain”.

Write the backup as unencrypted files and take the key files out

sudo /opt/smitey/Backup/TicketSystemBackup decrypt ticketsystem-backup-*.smbk --out plain && sudo tar -xf plain/volumes/dataprotection_keys.tar

The folder holds exactly one backup. Afterwards the files key-*.xml are in it. The subfolder “plain” holds the whole backup unencrypted.

Copy the files into the key folder

for f in key-*.xml; do sudo podman cp "$f" container-backend-1:/app/DataProtection-Keys/; done

Existing files with a different name stay in the key folder.

Give the files the right owner

sudo podman exec -u root container-backend-1 chown -R 1654:1654 /app/DataProtection-Keys

The ticket system runs in the container as a user of its own. The files must belong to it.

Restart the server of the ticket system

sudo podman restart container-backend-1

After the restart the system reads the key ring again.

Windows: Write the backup as unencrypted files and take the key files out

& "C:\Program Files\SMITEY\Backup\TicketSystemBackup.exe" decrypt <file>.smbk --out plain | Out-Host; tar -xf plain\volumes\dataprotection_keys.tar

In PowerShell as an administrator, in the folder with the backup. Replace <file>.smbk with the full file name of the backup. Afterwards the files key-*.xml are in it.

The last way out: “Discard old key”

If you have no backup with the key files, “Discard old key” remains. Only an administrator sees the button. Type DISCARD into the “Confirmation word” field and click “Discard old key”. The system then creates a new key.

Anonymizations by account keep working. People who were anonymized only by their address are no longer recognized in backups and archives afterwards. The card names how many. An older backup can therefore make these people visible again. The saved passwords for mail and SSO stay unreadable. Enter them again.

Restoring a backup

When you restore, “Ticket System Backup & Restore” asks whether everyone anonymized today should be anonymized again. “Yes” is preselected. The ticket system does this in the next nightly run at 03:00 in its time zone. Until then the card shows “… will be applied again tonight at 03:00.”

The backup also brings back the switches and time limits of that time. So check the “Data protection” card after restoring.

If there were warnings while carrying over, the status line of the application says how many, for example “2 warning(s) while carrying over anonymizations. See the Log tab.” On the command line the same appears in the last line and points to “backup.log”. That is where it says what did not work. If the anonymizations could not be carried over, repeat the runs made after this backup by hand. The list you downloaded before restoring helps with that.

The ticket system reads the carry-over file of the application at its next start. If it cannot read it, the card shows “A carry-over file from the backup app could not be read”. The file stays on the server and is read again at the next start. Then restore the backup once more with the current version of the application.

If the key of the backup does not match, anonymizations by address cannot be carried over. The card then shows “… could not be carried over from before the restore”. If you know these people, anonymize them again with “Export by e-mail address”.

The “Last run” line under “Restore from a backup” shows how many anonymizations the run applied again.

7

Roles and the permission concept

There are three roles: “Admin”, “Agent” and “Customer”. No further ones can be created. What is free instead is nearly every single permission; the exceptions are listed further down.

You find those three under “Settings → General Settings” on the “Role” tab. They cannot be renamed.

What a role may do sits somewhere else: under “Settings → Security” in the “Permission concept” card.

Every line is one function, every column one role. A tick allows it. Below the name stands the internal key; you do not need it to work with the page.

The list is long. It ranges from user management through access to the individual settings pages all the way to time tracking.

The “Agent Team” column is the special case. It only becomes usable once the “Agent” tick is set in the same line. Pick a team there and the permission applies to that team’s agents only.

No permission can be taken away from the “Admin” role. The tick is back after saving. That way nobody can lock themselves out of their own system. Only an administrator can change the table. That holds for every setting on the “Security” page. Anybody else who may open the page sees it read-only. Six permissions can never be given to the “Customer” role: “Users: manage accounts”, “Data export (data subject request)”, “Anonymize people”, “Security log”, “Settings: Security” and “Settings: Single sign-on”.

With “Save” the change applies immediately. Whoever is affected notices at their next click.

The “Permission concept” card with the table: one line per function, columns for admin, agent, agent team and customer.
The red frame sits on the header row. The picker in the “Agent Team” column is only usable where the “Agent” tick is set.Open image at full size
The “Role” tab with the three roles, each marked “Mandatory”.
The red frame sits on the note. The three roles are marked “Mandatory”. None of them can be deleted.Open image at full size
8

Department, position and site

Three lists describe the person and not the ticket: department, position and site.

They are created under “Settings → General Settings” in the “Drop-down lists” card. The handling is the same for all three.

They are assigned on the account. In the form under “User management” the fields are called “Department”, “Position” and “Location”.

In the user list the department stands below the team. Position and site are visible in the account’s form.

The site has a second use. There is a “Location” field on the ticket, and it draws from the same list.

Each of the three lists has one entry you cannot delete. It is called “None selected or available” and carries the “Mandatory” badge.

If you delete another entry, everyone who carried it moves to that placeholder. So nobody is left pointing at something that is gone.

You do not translate here but in one go on the translation page. The English name is the anchor the translations hang on.

The “Edit user” dialog with the department, position and location fields filled in.
The red frames sit on the three fields. They stand next to the team but mean something else: the team says who works the tickets, the department says where the person works.Open image at full size
The user list with the “Team” column holding the department below the team name.
The red frame sits on the column. The team is on top, the department below it. Whoever is in no team has a dash in that spot.Open image at full size

Email integration

The ticket system collects mail from a mailbox and sends mail itself. How to set that up is on the card “Tickets from e-mail, replies and follow-ups” in the Ticket management block. This block shows what becomes of an incoming mail, how you block senders, and which messages the system sends on its own. The whole mail channel is part of the Professional edition.

1

What becomes of an e-mail

Professional only

When someone writes to a team mailbox, a ticket is created from it. The subject becomes the title, the text becomes the description, and the sender address is recorded as the requester. The channel on the ticket says “E-mail”.

If the mail carries a sender name, that name goes into the field next to the address. If it does not, the field says “E-Mail”. The channel already says the matter arrived by mail.

Prefixes such as “Re:” or “Fwd:” are dropped from the title. The ticket then carries the name of the matter and not that of a reply to it.

The formatting of the mail is kept. Bold text, lists and tables appear in the ticket exactly as they did in the mail.

Links are kept. Your agent can click them in the ticket instead of typing the address out.

A picture that is embedded in the mail stays where it was in the text. It is also stored as an attachment on the ticket.

A picture that the mail only loads from the web is removed. Such pictures often report back to the sender when and where a mail was read. Anyone who wants a picture to arrive should embed it in the mail or attach it.

Files attached to the mail become attachments on the ticket. Only the file types pdf, doc, docx, xls, xlsx, txt, png, jpg, jpeg and gif are taken over. Other files are dropped. The same size limit applies as for a file an agent uploads.

If the auto-reply is switched on in the workflow, the sender gets a confirmation straight away. With the reference in the subject, every further reply finds the same case again and becomes a comment on it.

A picture embedded in such a reply appears on the comment it belongs to.

If the requester replies to a ticket that is resolved or closed, it goes back to “Reopened”. The same happens when the requester comments in the customer portal. Replies from people in copy, from observers and from agents reopen nothing.

More on this in the card: Tickets from e-mail, replies and follow-ups

The sent mail in the sender’s mail program, with an embedded picture and a link.
This window is not the ticket system, it is the sender’s mail program. The mail contains an embedded picture and a link.Open image at full size
The description of the resulting ticket with the picture in place and the link.
The same mail as a ticket. The red frames sit on the picture and on the link. Both are in the same place as in the mail, and the link can be clicked.Open image at full size
The “Attachments” tab of the ticket with the file inline_image_1.png.
The embedded picture is also stored as an attachment. That way it can be downloaded without pulling it out of the text.Open image at full size
The confirmation in the sender’s inbox, with the reference in the subject.
The confirmation as it arrives at the sender. The subject carries the reference of the case. If the sender replies to it, the reply lands on the same ticket.Open image at full size
2

Blocking senders

Professional only

Before you start: The blocklist sits at the very bottom of the “E-Mail Settings” page. It applies to all teams at once.

Some senders should not create a ticket. Newsletters are one example, and mailboxes that only send machine reports are another.

Enter a full address when exactly one sender is meant. In the picture that is no-reply@example.com.

Enter the domain with a leading @ when every address of one sender is meant. In the picture that is @newsletter.example.net. Subdomains are blocked along with it.

A mail from a blocked sender creates no ticket. It is marked as read and moved to the processed folder. Nothing piles up in the inbox.

The block works in the other direction as well. The system sends no mail to a blocked address.

That is the real point with addresses nobody reads. Without the block, the confirmation would go to a mailbox that never answers.

“Add” puts an entry on the list. The bin icon next to it removes the entry again. A change takes effect immediately, there is nothing to save.

Mails that were generated automatically need no entry on the list. This covers bounce messages, out-of-office replies and bulk mail. They create no ticket either and get no reply. The system marks them as read and moves them to the processed folder.

This also applies to alarms from a monitoring system if they are marked as automatically generated mail. An alarm without that marking becomes a ticket like any other mail.

The “E-Mail Blacklist” card with two entries: a full address and a domain.
The red frame sits on the input field. Its placeholder names both permitted forms. Below it are the two entries of this installation.Open image at full size
3

What the system sends on its own

Professional only

Before you start: The switches on this card sit per team under “Team mailboxes” on the “E-Mail Settings” page, directly below that team’s mailbox address.

Besides the replies to your customers, the system sends messages of its own. These include the assignment of a ticket, a breached deadline, an invitation, a new password, the satisfaction survey and the approval of a request.

These texts come ready made and are English to begin with. They sit in the language pack together with every other text of the interface.

Once a language pack is imported, each of these messages goes out in the language set on the recipient. Two people on the same matter therefore receive the message in two languages. Recipients without an account have no language of their own. Mails to them go out in the language set on the team under “Default e-mail language”. That covers, for example, the survey, the resolution of an incident, a rejection and the mail of a rule.

You change the wording on the languages page. There you download the texts of one language as a file, edit it and upload it again. English is the source and stays as it is.

Whether an assignment is announced at all is decided per team. Three switches sit below the mailbox for that.

“Send assignment e-mails” sends a mail to the agent who receives a ticket. With the switch off, this team announces no assignments at all.

“Notify on self-assignment” decides whether a mail is also sent when someone takes a ticket themselves. This switch is off by default.

“Send mail on ticket actions” takes effect elsewhere. With it on, the dialogs for closing, for changing the status and for handing over offer to send the comment as a mail as well.

The confirmation to your customers does not belong here. You write its text yourself, in the workflow of the mailbox.

More on this in the card: Tickets from e-mail, replies and follow-ups

The “Assignment notifications” section with three switches.
The red frames sit on the three switches. They belong to the team mailbox above them. Every further team has the same three switches of its own.Open image at full size

Authentication & security incl. SSO

Who gets in and how is decided in two places. The security page governs sign-in with a username and password. The SSO page connects a directory or an external sign-in service. You can run both at the same time.

1

Signing in with a username and password

Before you start: The settings on this card live under “Settings → Security”. Only an administrator can change them. Anybody else who has been given the page sees it read-only.

Out of the box everyone signs in with a username and a password. The e-mail address works instead of the username. If mail delivery is set up, the link “Do you need a password reset?” appears below the form. Mail delivery is part of Professional.

After signing in the browser is given a pass that is valid for a set time. The “JWT token timer” card decides how long. Values from 1 to 24 hours are allowed, 12 is the recommendation. After that the person has to sign in again.

The “Password policy” card applies to every password set in the system. It is enforced when an account is created, when a person changes their own password and when an administrator resets one.

You set the minimum length, which kinds of characters must appear, after how many days a password expires and how many old passwords stay blocked. For the days and the block list, 0 means “off”.

The rules about upper and lower case do not lock any language out. Many writing systems have no such distinction at all, and a character from one of them satisfies both rules on its own.

Accounts that only sign in through SSO or a directory have no local password, so expiry does not apply to them. Their rules live at the provider. If an existing account was linked to SSO and still has its own password, expiry and the password policy keep applying to that password.

The “2FA Settings” card decides who has to use two-factor sign-in. Under “Two-factor requirement” you choose one of four options: “Off”, “Administrators only”, “Administrators and agents” or “Everyone”. “Everyone” includes customers. A new installation starts with “Administrators only”. An installation that existed before keeps its previous setting after an update.

Whoever signs in next without a second factor sets one up. The system shows a QR code for an authenticator app and the same key to type in by hand. After the first code the factor is active. With “Set up later” the setup can be postponed, and the sign-in continues without it. That works for at most 7 days, counted from the first time it was postponed. The line under the button shows the days left. After that the setup is required.

Right after that, ten recovery codes appear. Each of them replaces the code from the app once. They are shown exactly once. You save them with “Copy” or “Download”. “Download” always works. “Copy” usually works too.

If someone loses their device and their codes, the administrator helps. In the user list, the button with the crossed-out shield resets that person’s two-factor sign-in. They set it up again at the next sign-in.

The codes depend on the server clock. If it is wrong, no code is accepted. The “Check now” button on the same card compares the server time against a public time source.

If someone signs in through an external sign-in service, the system does not ask for a code. The provider has already checked the second factor. Directory sign-in is different: there the rule above still applies.

More on this in the card: Two-factor sign-in in your own profile

The sign-in page with the “Username” and “Password” fields and the “Sign in” button.
The red frames sit on the two fields and the button. The upper field also accepts the e-mail address.Open image at full size
The “JWT token timer” card with the field for the number of hours.
The red frame sits on the field. It accepts values from 1 to 24.Open image at full size
The “Password policy” card with minimum length, character kinds, expiry and block list.
The red frames sit on the three number fields. The checkboxes between them decide which kinds of characters must appear.Open image at full size
The “2FA Settings” card with the four options under “Two-factor requirement”.
The red frame sits on the four options. “Administrators only” is selected, as in a new installation.Open image at full size
The setup screen with a QR code, a key to type in and the field for the first code.
The upper red frame sits on the key. It is the same thing as the QR code above and helps when the camera reads nothing. The lower one sits on “Set up later” and the days left.Open image at full size
Ten recovery codes in two columns, with “Copy” and “Download” below.
The red frames sit on the codes and on the two buttons. The codes appear exactly once. The codes in the picture come from a test system and are worthless.Open image at full size
The user list with the button that resets two-factor sign-in.
The red frame sits on the crossed-out shield in Marco Rossi’s row. One click takes away his app and his recovery codes.Open image at full size
2

Two-factor sign-in in your own profile

Every user can turn on two-factor sign-in for their own account. That applies to every role, also when the “2FA Settings” card does not require it. Open the user menu at the bottom left of the sidebar and choose “Profile picture”. The same page holds the “Two-factor authentication” area.

The area shows whether two-factor sign-in is on. While it is off, the “Turn on” button is there. It first asks for your password. Then a QR code for the authenticator app appears, with the same key to type in by hand. After the first code from the app the factor is active.

Right after that, ten recovery codes appear. Save them with “Copy” or “Download”. “I have saved my codes” closes the list. It is shown only this once.

While two-factor sign-in is on, the area shows how many recovery codes are left. “New recovery codes” creates ten new ones. The old codes then stop working. “Turn off” switches two-factor sign-in off again. Both buttons ask for the current code from the app. A recovery code is not accepted there.

If the “2FA Settings” card requires two-factor sign-in for your role, “Turn off” is missing. A line in the area says so.

A wrong password or a wrong code counts like a failed sign-in. The protection against password guessing applies here too. Turning it on and off is recorded in the security log. If an administrator turns off their own two-factor sign-in, the log raises an alert.

Accounts that only sign in through an external sign-in service see a sentence instead of the buttons. Their provider handles the second factor. Accounts from a directory enter their directory password in the first step.

More on this in the card: Signing in with a username and password, The security log

The “Two-factor authentication” area in the profile with the status and the “Turn on” button.
The red frames sit on the status and on “Turn on”. Here two-factor sign-in is still off.Open image at full size
The first step after “Turn on”: the “Password” field with “Continue” and “Cancel”.
The red frames sit on the password field and on “Continue”. The QR code only appears after the correct password.Open image at full size
3

Protection against password guessing

The protection runs without any setting. There is nothing to switch on. The note about it stands in the “2FA Settings” card.

It works in two stages. After five failed attempts for the same account, the address they came from is paused. The pause ends at the latest 15 minutes after the first of those attempts. From every other address the account stays usable straight away.

That is the important part. Otherwise anyone who knows a sign-in name could lock a colleague out with five wrong passwords. They would never need a password to do it.

The second stage is the account itself. It is locked for 15 minutes after 20 failed attempts. Because a single address can contribute at most five of them, that takes several addresses.

A successful sign-in resets both counters. After a server restart the address pause is gone, the account lock remains. The same counters apply to sign-in through a directory. An unreachable directory does not count as a failed attempt. If there is no account for the name in the ticket system yet, only the address pause applies.

In the user list an account locked this way carries the “temporarily locked” badge. It stays in the list. After 15 minutes the badge disappears on its own.

You do not have to wait. In the same row there is a button with an open padlock. It lifts the lock immediately and clears both counters.

This is not the same as “Archive”. That button shuts an account down for good, and only it takes or frees a staff seat.

The note about protection against password guessing in the “2FA Settings” card.
The red frame sits on the note. It names both stages: the address first, the account last.Open image at full size
The user list with the “temporarily locked” badge and the unlock button.
The red frames sit on the badge and on the open padlock. The padlock only appears in the row where there is something to lift.Open image at full size
4

The security log

Before you start: The log is under “Settings → Security log”. By default only administrators see it. You give it to other roles with the “Security log” permission in the “Permission concept” card. It cannot be given to customers.

The security log records two kinds of events. The “Sign-in” area holds failed sign-ins, locked accounts, sign-in attempts during a lock, rejected two-factor codes and password changes. This applies to sign-in with a password, through a directory and through SSO.

The “Administration” area shows who changed what. That covers accounts, roles, permissions, security settings and archives. Every export of the log is recorded there as well.

Successful sign-ins are only recorded in two cases. The first case is an administrator. The second case is a sign-in after failed attempts on the same account. The ordinary sign-in of an agent or a customer is not in the log. The log is not an attendance list.

If someone signs in with a name that does not exist, the entry says “unknown account”. The system does not store the typed name. Sometimes it is a password that ended up in the wrong field.

Sign-in events store the IP address and the browser. Administrator actions store who carried them out, but no IP address. Passwords, codes and the contents of tickets or e-mails are never in the log.

The page shows the newest entries first, 50 per page. The “Filters” card narrows the list. “Area” picks sign-ins or administration, “Event” a single kind of event. “Person” searches the name of whoever acted and of whoever was affected. “From” and “To” limit the days. “Failures only” hides everything that succeeded.

The filters only take effect after a click on “Apply”. “Reset” removes them again.

“Export CSV” and “Export PDF” download exactly what the filters show. Each file holds at most 10,000 entries. If more entries match the filters, a note at the export buttons says so. The PDF is in your language and names the filters and the period at the top. Date and time use the format set under “Settings → General Settings”.

The CSV file always stays in English, and the times are in UTC. That way a program can read it regardless of the language. Every export is itself in the log, as “Security log exported”.

Six events raise an alert. These are an account locked after failed attempts, a role changed to “Admin”, an account created with the “Admin” role right away and a reset two-factor sign-in of an administrator. Then there are archived tickets removed from the live data, and an administrator’s sign-in after failed attempts.

After an alert, everyone with the permission sees a yellow banner at the top of every page. It names the number of alerts since their last visit to the log. The “Open security log” link leads there. Opening the log makes the banner disappear. Before the first visit it counts the alerts of the last seven days.

In addition, every active account with the permission and an e-mail address receives an alert mail. The system collects the alerts every 15 minutes and sends one mail per person, not one per event. The mail names the event, the affected person and the time. It contains no IP address. The alert mail is part of Professional.

The nightly run deletes old entries. The time limits are under “Settings → Security” in the “Data protection” card, in the “Security log retention” block. Sign-in events are kept for 90 days by default, 7 to 365 days are allowed. Administrator actions are kept for 12 months by default, 1 to 120 months are allowed.

Each time limit has its own switch: “Delete old sign-in events” and “Delete old administrator actions”. If a switch is off, those entries stay. The card “Retention periods” explains the nightly run.

In a data export, the person receives every entry in which they acted or were affected. IP address and browser are only included for entries they triggered themselves, for example their own sign-in. If the person is anonymized, the system deletes their sign-in events. Their administrator actions stay. Their name there is replaced by the placeholder.

A note for you as the operator: successful sign-ins are only in the log for administrators and after failed attempts. Even so, the log shows who did what and when. In a company with a works council it is therefore a matter for co-determination.

More on this in the card: Protection against password guessing, Retention periods

The “Security log” page with the “Filters” card and the list of entries.
The red frame sits on the lock of Lena Chen’s account. Below it are the failed attempts that led to it, each with its IP address. The entries in the picture come from a test system.Open image at full size
The “Filters” card with “Failures only” switched on, the two export buttons and the first failures.
The red frames sit on “Failures only” and on the two exports. The exports take over the filters set here.Open image at full size
The yellow banner above the dashboard with the number of security events and the “Open security log” link.
The red frame sits on the link to the log. Here the lock of Lena Chen’s account raised the alert.Open image at full size
The “Security log retention” block with two switches, the days and the months.
The red frames sit on the two time limits. The picture shows the factory setting: 90 days and 12 months.Open image at full size
5

Signing in through a directory or an external service (SSO)

Professional only

Before you start: The settings live under “Settings → SSO Settings”. Without a configured provider nothing changes on the sign-in page.

At the very top sits the master switch “Enable single sign-on”. While it is off, it stays with username and password. Everything you set up below it is saved and only takes effect once you switch it on.

The “Active Directory / LDAP” card connects an on-premise directory. You enter the server, the search base, the filter that finds a person, and the fields for the e-mail address and the names.

The account used for lookups is optional. Without one the system asks anonymously. A person’s password is only used to bind against the directory and is never stored.

A directory brings no second factor of its own. If the security page requires two-factor sign-in, these people are asked for it as well.

The “Identity providers” card holds the external sign-in services. Each gets its own tile and its own button on the sign-in page. “Add provider” creates a new one.

Under “Provider type” you pick the kind. “Generic OIDC Provider” fits services such as Google Workspace, Microsoft Entra ID, Okta, Keycloak, Auth0 or Ping Identity. “SAML 2.0 Provider” fits the same houses when they are to be connected over SAML.

Alongside them are six regional services: LINE, Kakao, Naver, WeChat, WeCom and DingTalk. Their addresses are pre-filled and appear as grey text in the field.

The name under “Display name” later appears on the button. The switch next to it applies to this one provider only.

For the callback address, work in this order. First enter only a name and click “Save provider”. Only then does the system know the provider’s number and show the finished address under “Redirect URI”. It is built from the public address of this installation, the one stored under “Settings → Security”. That is exactly the address the system uses when someone signs in.

You copy that address and register it with the provider. It has to match there character for character. In return the provider gives you an ID and a secret, and you enter those here via “Edit”.

The “Allowed e-mail domains” field limits who may come in through this provider. Left empty, every domain is allowed.

If a provider is still missing something, its tile carries the red “Incomplete” badge. It then does not appear on the sign-in page. The text beside it says which fields its type needs.

Fully configured providers still do not appear while the master switch is off. The tile says so in a yellow line.

If your licence falls back to Basic, sign-in through SSO and the directory keeps working. On this page you can then only switch providers and the directory off. The log of sign-in attempts stays readable.

The “Single sign-on” card with the master switch.
The red frame sits on the master switch. With it off, only username and password sign-in remains.Open image at full size
The “Active Directory / LDAP” card with the fields filled in.
The red frames sit on the server, the search base and the search filter. The values in the picture come from a test system.Open image at full size
Two provider tiles, one configured and one carrying the “Incomplete” badge.
The red frames sit on both tiles. The upper one is complete and only waits for the master switch. The lower one is missing its provider’s address.Open image at full size
The “Add provider” dialog with type, display name, switch and the provider’s address.
The red frame sits on the address field. Below it, “Quick fill” pre-fills the well-known providers. Whatever stands in curly brackets you replace first.Open image at full size
The dialog of a saved provider showing the finished callback address.
The red frame sits on the callback address. It only comes into being on saving and starts with your own installation’s address.Open image at full size
6

The account on first sign-in, and the log

Professional only

The “Automatically create accounts on first sign-in” switch sits in the same card as the master switch. It is on by default.

When someone signs in through a provider for the first time, the system first looks for an account that already belongs to that provider. If it finds none, a new one is created.

The new account gets the “Customer” role and no team. A customer needs no membership to create a ticket and is therefore able to work straight away.

Customers are unlimited in both editions, so an account created this way uses no staff seat. Anyone who is meant to become an agent gets the role afterwards in user management.

If an account with the same e-mail address already exists, the two are linked. This only happens when the provider reports the address as verified. If it does not, the sign-in is refused.

If you switch it off, only people who already have an account get in. Everyone else is turned away.

The “Recent sign-in attempts” card at the bottom shows the last 100 sign-in events through SSO and the directory. They come from the security log. Failed attempts are always listed. A successful sign-in is only listed for administrators and after failed attempts on the same account. So not every sign-in appears in the list.

Each row names the time, the provider, the result and the source address. On a failed attempt the reason stands next to it. The “User” column shows the name of the account. If there is no account, it shows the address the provider reported, otherwise “unknown account”. The system does not store the name that was entered.

Sign-in with a username and password does not appear in this table. It is not SSO. You find it in the security log.

By default the entries are deleted after 90 days. The sentence below the card title names the time limit that is set. The card “Retention periods” explains the setting.

More on this in the card: The security log

The “Automatically create accounts on first sign-in” switch.
The red frame sits on the switch. The text below it names the role such an account is given.Open image at full size
The “Recent sign-in attempts” table with three failed attempts through the directory.
The red frame sits on the top row. It shows a failed attempt with its reason. The entries in the picture come from a test system whose directory does not exist.Open image at full size
7

The five ways to reach the system

Before you start: You choose how the system is reached in the SMITEY installer on the server. You can change it later at any time.

After the installation, your team uses the system in every web browser. The installer asks how the system should be reached. In the Windows installer you choose this on the “Reachability” page. On Linux, install.sh asks the same question and numbers the options from 1 to 5. Later you change it with “Change how SMITEY is reached”. Your data stays where it is.

The option “Local network only, via the IP address (HTTP) - simplest option” is the default setting. Your team opens the system at http:// followed by the IP address of the server and the port, for example http://192.168.1.20:8088. The port is 8088 unless you choose another one. Port 80 works too. Then the address needs no port. This option needs no name and no certificate.

The option “In the local network under its own name (HTTP, HTTPS possible later) - you have internal DNS” works like the first one, but under a name such as ticket.company.local. You create the name yourself in your internal DNS. It points to the IP address of the server. Then your team reaches the system by the name and still by the IP address. The installer then shows the address with this name.

With both HTTP options, passwords and tickets travel through your network in plain text. Administrators then see a notice at the top of the page.

The other three options use HTTPS: “Via a public domain with HTTPS (automatic, using Let’s Encrypt)”, “In the local network with HTTPS and your own certificate” and “In the local network with HTTPS, certificate created by SMITEY”. They need ports 80 and 443 on the server. The next card describes them.

For a first test, the first option is enough. If your network has internal DNS, choose the second one. If the system should be reachable from the internet, choose the public domain. If your company has its own certificate authority, choose your own certificate in the local network. Otherwise let SMITEY create the certificate.

Change how SMITEY is reached on Linux

sudo bash /opt/smitey/install.sh --change-access

Shows options 1 to 5. Enter alone keeps the current option and changes nothing.

More on this in the card: Reaching the system over HTTPS

The “Reachability” page in the Windows installer with the five options.
The text above the list counts the options from 1 to 5. On Linux the same texts appear with these numbers.Open image at full size
8

Reaching the system over HTTPS

Before you start: You choose the way to HTTPS in the SMITEY installer on the server, not in the browser.

Without HTTPS, passwords and tickets travel through your network in plain text. A new installation starts with plain HTTP, so it works right away in every web browser. As long as an administrator opens the system over plain HTTP, a notice appears at the top of the page: “This connection is not encrypted.” If the system is opened on the server itself under “localhost”, the notice does not appear. Agents and customers never see it.

“How to switch on HTTPS” leads to this card. “Hide for 30 days” hides the notice for you. The setting belongs to your account, so it also applies in another browser. After 30 days the notice comes back as long as the connection is still not encrypted.

The SMITEY installer sets up HTTPS in three ways. In the Windows installer you choose it on the “Reachability” page, and on Linux install.sh asks the same question. On a system that is already running, open “Change how SMITEY is reached” on the Windows desktop or in the Start menu. On Linux the command below does the same. Your data stays where it is.

The option “In the local network with HTTPS and your own certificate” uses your own certificate, for example from your company CA. The installer asks for the name of the system and for the certificate file with its key. A PFX file with its password works too. Before it changes anything, it checks the certificate. The key must match, the certificate must be valid, and the name must be in the certificate.

The option “In the local network with HTTPS, certificate created by SMITEY” needs no certificate of your own. SMITEY creates one itself and renews it on its own. The installer saves the root certificate as SMITEY-root-ca.crt in the installation folder. Install this file as a trusted root certificate on every computer, for example with a group policy. Until then, browsers show a warning.

The option “Via a public domain with HTTPS (automatic, using Let’s Encrypt)” gets its certificate from Let’s Encrypt. It needs a public domain that points to the server. For that, the server must be reachable from the internet.

For both options in the local network the name can be a name like ticket.company.local, a single word like helpdesk or an IPv4 address. All three ways need ports 80 and 443 on the server. If another program uses them, the installer stops and changes nothing. The system is then reached at https:// followed by the name, without a port.

Your own certificate expires at some point. From 30 days before, administrators see a notice with the date at the top of the page. From 7 days before, it is red. In Professional, all administrators with an e-mail address also get a mail 30 and 7 days before. To renew, open “Change how SMITEY is reached” again, choose the option with your own certificate and give the new files.

The file HTTPS-GUIDE.txt that comes with the installation describes every step. That includes distributing the root certificate and the steps by hand.

Change how SMITEY is reached on Linux

sudo bash /opt/smitey/install.sh --change-access

Shows options 1 to 5. Enter alone keeps the current option and changes nothing.

The notice “This connection is not encrypted.” above the ticket list, with the link and “Hide for 30 days”.
The red frames sit on the link to this card and on “Hide for 30 days”. Only administrators see the notice.Open image at full size

Ticket management

The daily craft: creating tickets, sorting them, finding them again. Everything in this block is part of Basic unless a card says otherwise.

1

Creating and editing tickets

Before you start: A single ticket cannot be deleted — not even by an administrator. Tickets only leave the database through the archive, and only once they are closed. That is on purpose: a case that someone can remove without a trace is worthless as a record.

You create a new ticket with “New Ticket” in the left-hand bar. The form is called “Create new ticket”. As an agent you also record other people’s requests with it — that is what the “User” field is for: it says who the case is for, not who is typing it in.

Everything with a star is mandatory: “Title”, “User”, “Main category” and “Description”. One more that is easy to miss: the form will not save without a subcategory, even though “Subcategory” carries no star — a main and a sub category belong together and are always set as a pair.

Which fields are mandatory is set under “Settings → Ticket Settings”. The “Admin / Agent Field Settings” card only has the “Field is mandatory” switch for this. The “Customer Field Settings” card also has “Is hidden for Customer” and “Is not editable”. That is why a customer can see a shorter form than you do, without anyone having to maintain two forms. “Title” and “Description” are always mandatory. That cannot be switched off.

Afterwards you can change nearly everything: on the right of the ticket sits the “Details” card with requester, phone, e-mail, location, category and reference number; you change the field itself and confirm with the “Save” below it. Status, assignment, priority, channel and observers sit one card higher under “Actions”. Status and assignment take effect immediately. Priority, channel and observers are only saved with the “Save” in the “Details” card.

Only agents and administrators may change this. The requester can read the case, comment on it and attach files — but not change the classification your reporting is built on.

One side effect worth knowing once: if you edit a ticket that belongs to nobody yet, it belongs to you afterwards. The system enters you as the agent and moves the status from “Open” to “Assigned” — both end up in the history. If you did not want that, assign it to somebody else afterwards.

Every one of these changes lands in the ticket’s history, with name, time, old value and new value. You do not have to switch anything on for that.

That leaves the question of how to get rid of tickets again. Under “Settings → Archive” you pick a date range, see with “Preview” how many closed tickets it contains, and create a ZIP file with “Create archive”: tickets, comments, history, custom fields and attachments, all in one file. Creating it removes nothing. The tickets only leave the live database with the separate step “Delete from live DB” in the “Existing archives” list — and they can be restored from that same file.

The “Create new ticket” form with the fields Title, Owning team, User, status, priority, channel and observers.
The form behind “New Ticket”. The starred fields are mandatory; categories, description and attachments follow further down.Open image at full size
The “Details” card of a ticket with the requester fields and the “Save” button framed in red.
Changing things later: edit the field, press “Save”. Below it stands, unchangeable, who created the ticket and when.Open image at full size
2

Rich-text editor for description and comments

The description and the comments are not bare text boxes. Each has a toolbar above it, and the buttons say what they do when you point at them: “Bold”, “Italic”, “Underline”, “Strikethrough”, “Text color”, “Highlight color”, “Bullet list”, “Numbered list”, “Quote”, “Link” and “Clear formatting”.

This is how a link is made: select the text, click “Link”, type the address into the small prompt. An empty entry removes the link again. Web and mail addresses are allowed (http, https, mailto) — everything else is thrown away when saving, so that a comment cannot slip anything past anyone.

Images come in through the clipboard: take a screenshot and paste it straight into the editor with Ctrl+V. At first the text only shows a marker such as “[inline-image:1]”. When you save, the system uploads the image and displays it exactly there — and it also lands in the “Attachments” tab, where all files of the case live. Pasting images works in the description of an existing ticket and in a new comment. It does not work in the “Create new ticket” form or while you edit a comment.

What you see is what the others see: formatting, lists and links are kept in the ticket, and in the mail to the requester as well. Foreign markup — from a copied web page or an incoming e-mail, say — is trimmed back to this allowed set. None of your text is lost in the process, only the wrapping.

A comment can be marked internal with “Internal note (not visible to the customer)”. It then carries the “Internal” badge and is invisible to the requester — not even the search will surface it.

Everyone can change and delete their own comments. What a customer wrote can only be changed or deleted by that customer or by an administrator. That includes their mails. Comments by colleagues can be changed and deleted by every agent who may work on the ticket. That includes a team that had the ticket earlier.

The editor toolbar, below it the sentence “The display shows ERROR 13.20 and then the paper jams.” with the error code in bold.
Framed in red: “Bold”, “Bullet list” and “Link”. The bar sits above the description as well as above the comment box.Open image at full size
Three comments of a ticket, the lower one with a bold term and a bullet list, the middle one carrying the “Internal” badge.
This is how it arrives: bold text and the list are kept. The middle comment is marked “Internal” and invisible to the requester.Open image at full size
3

File attachments with preview

Before you start: Allowed are PDF, DOC, DOCX, XLS, XLSX, TXT, PNG, JPG, JPEG and GIF, up to 50 MB per file. The limit is stated in the form (“Max. 50 MB per file”), and larger files are rejected before the upload starts.

Files belong to the case, not to a single comment. On the ticket the “Attachments” tab leads to the list: “Upload file” adds one, every row names the file, its size and its date. Anyone involved in the ticket may attach something — the requester included; so nobody has to mail you their screenshot. A customer can only delete attachments they uploaded themselves. When a child ticket is closed, its attachments are copied into the parent ticket, where they carry the “Internal” badge. Agents see them; customers neither see nor download them.

A click on the name opens the preview, without you having to download the file. For images you can zoom in, zoom out and rotate in there — useful for a display that was photographed at an angle. A PDF is displayed in the same window, with page overview, zoom and print. Text files are shown as text. With “Open in new tab” you open the file in a window of its own.

An attachment belongs to the case and travels with it: it appears in the history (“File uploaded: …”), survives a handover to another team, and ends up inside the archive file when the ticket is archived.

The “Attachments” tab with two files, above them the “Upload file” button framed in red.
All files of a case in one place. The line below names the allowed file types and the size limit.Open image at full size
The image preview of an attachment with the zoom-in, zoom-out and rotate buttons in the top right.
The preview of an image: zoom in, zoom out, rotate — top right. Nothing is downloaded in the process.Open image at full size
The preview of a PDF in the same window, with the page overview on the left and the PDF viewer toolbar on top.
A PDF opens the same way — no download, with page overview, zoom and print.Open image at full size
4

Ticket history

The “History” tab on the ticket answers the question behind every follow-up: who changed what, and when? Every row names the person, the field, the old value struck through, the new one behind it and the time down to the second. The newest entry is on top.

Entries are written without your doing — on status changes, priority, assignment, category, location, observers, title and description, as well as on creation (“Ticket opened”), on every comment and on every uploaded file. The number on the tab tells you in advance how much movement there was in the case.

The history cannot be edited and cannot be switched off. That is exactly what makes it useful: it is the reason a ticket cannot be deleted one by one, and it travels into the archive file when the ticket is archived.

For a comment, the history only records that it was added, edited or deleted. The wording lives in the “Comments” tab. An internal comment shows up in the history as well, but only for agents and administrators.

The “History” tab with this ticket’s entries: files, comments, status changes, priority, assignment and, at the very bottom, the opening — with two rows at the top written by a rule.
Framed in red, the tab with the count. On “Status” and “Priority” you see the old value struck through next to the new one.Open image at full size
5

Status workflow with configurable statuses & transitions

The status says where a ticket currently stands. Twelve statuses ship with the system — Open, Assigned, In Progress, Waiting for User Response, Resolved, Closed and more. You find them under “Settings → General Settings” in the “Drop-down lists” section behind the “Status” tab; “+ Add status” creates one of your own, “Edit status” opens an existing one.

The important part is the difference between the name and the meaning. In the editor of a status, under “Meaning of this status”, there are three switches: “Counts as resolved”, “Counts as closed” and “Waiting for the requester”. Only these switches tell the system how to treat a status.

You may rename every status, including the ones that ship with the system: at the bottom of the editor, under “Translations”, there is a “Name” field per language — put in there what your people should read. The technical name behind it stays untouched, and that is exactly why nothing breaks: automation, reporting and the switches above hang on that name, not on your label. So “Resolved” can become “Done”.

Deleting, however, does not work for all of them. Eight statuses carry the “Mandatory” badge in the list — Open, Assigned, In Progress, Resolved, Closed, Reopened, Waiting for approval and Rejected. They can be renamed and reordered, but not removed; trying it ends with a clear message. That is not there to annoy you: processes hang on them that would otherwise quit without a word — for example the automatic closing, which needs a “resolved” status as its starting point.

Two statuses belong to the system itself: “Waiting for approval” and “Rejected” carry the “System only” badge. They come out of an approval process, and nobody should be able to claim by hand that something was rejected which never went up for decision.

What the three do: a status that counts as resolved closes the ticket by itself after 24 hours. A status that counts as closed is the final state the ticket is moved into. And “Waiting for the requester” means exactly that: we are waiting for the requester — not for another team and not for a service provider. That is the flag the SLA clock stops on, if you set it up that way.

Below that sits “Allowed transitions to new status”. Here you tick which statuses can be reached from this one. Leave everything empty and nothing is restricted; tick something and every other path is closed. That is how you build a flow that cannot be skipped — for example: from “Open” you can only go to “In Progress” or “Assigned”, but not straight to “Closed”.

The remaining switches in the editor are small things with a large effect: the colour for the list, “Sort order” for the order, “Show status in new ticket form” (should this status be selectable when creating a ticket at all?), “Requires comment in dialog” (force a reason) and “System only” for statuses only the system itself may set.

Up to four statuses appear on the ticket as buttons under “Change Status to:”. You choose them in the editor with the “Set as primary status (max. 4)” switch. As a factory setting these are In Progress, Waiting for User Response, Waiting for Service Provider Response and Resolved. All other statuses are under “More statuses”.

The general settings with the “Status” tab framed in red and the list of all statuses.
“Settings → General Settings”, “Status” tab: every status with its technical name and its flags.Open image at full size
The “Edit status” dialog with the switches under “Meaning of this status” and the “Allowed transitions to new status” list.
In the editor: appearance and behaviour on top, the meaning in the middle, the allowed transitions at the bottom.Open image at full size
7

Main and sub categories are freely configurable per team

Before you start: You need at least one team. The categories page is named after its team, so it only exists once you have created one.

Categories are what the requester or the agent picks when creating a ticket — and what you group your reports by later. Every team has its own: a helpdesk sorts by different things than a network department, and neither sees the other team’s lists.

You find them under “Settings” as the entry “<team name> Categories”. In the example the team is called “Helpdesk”, so the entry reads “Helpdesk Categories”.

The page has three cards: “Main categories”, “Subcategories” and “Links”. The quickest start: type the English name into the “EN (required)” field and click “+ New main category” or “+ New subcategory”. You translate everything later in one go on the translation page — nothing to prepare for that here.

If you have a lot of categories ahead of you, take the file route: “Export JSON” downloads the structure — on a freshly installed system the file is empty and only shows you the layout. You fill it in (by hand or with the help of an AI), save it and upload it again via “Import JSON”. It is not a way to rename things: you change a name in the field of that category and confirm with the “Save” next to it — the page says so as well.

The third card, “Links”, is where the actual work happens. Pick a main category at the top, tick the subcategories that belong to it below, and save with “Save links”. The trick: one subcategory may hang on several main categories. So you only need “Malfunction” once and re-use it for Printer, Network, Meeting-Room and Notebook.

From then on the categories are available in the ticket. Deleting can fail while tickets are still using a category — that is on purpose, otherwise old tickets would lose their classification. If you remove a link, tickets that use that pair can still be saved. Only a newly chosen category is checked against the links.

If you hand a ticket over to another team, its classification stays — even when the new team does not have those categories at all. It then sits in the field together with its origin, for example “Meeting-Room · from Helpdesk”, and is greyed out: the new team can see what the case ran as so far, but cannot assign that entry itself. To re-sort it you pick from your own list — and the system then wants a main and a sub category together.

The opened settings menu with the entry “Helpdesk Categories” framed in red.
Under “Settings” the entry is named after the team — here “Helpdesk Categories”.Open image at full size
The “Settings · Manage categories” page with the “Main categories” and “Subcategories” cards.
This is the page: main categories on the left, subcategories on the right. The “Links” card sits further down the same page — it follows in a moment.Open image at full size
The “EN (required)” field containing the word “Beamer” and the “New main category” button, both framed in red.
One by one: English name into the “EN (required)” field, then click “+ New main category” below it. In the “Subcategories” card the button is called “+ New subcategory”.Open image at full size
The “Main categories” card with the “Export JSON” and “Import JSON” buttons framed in red.
For many at once: download the structure, fill it in, upload it again. The “Subcategories” card next to it has the same two buttons.Open image at full size
The “Links” card: “Printer” is selected, the subcategories Consumables, Malfunction and New request are ticked.
“Printer” selected, matching subcategories ticked, “Save links” — “Malfunction” hangs on three other main categories at the same time.Open image at full size
8

How the ticket came in

Every ticket carries a channel. It sits in the form and later on the “Actions” card under “How the request came in”, and it answers a question that becomes important in reporting quickly: does the work arrive through the portal or over the phone?

You can only choose what a person knows and the system does not: “Phone” and “Entered by an agent”. The other two values are set by the system itself — “Self-service” when the requester created the ticket in the portal, and “E-mail” when it grew out of an incoming mail. When an agent creates a ticket, the form starts with “Entered by an agent”.

A channel the system has set cannot be changed by anyone later on. The field then says “Recorded by the system. It cannot be changed.” Otherwise the field would lose exactly the statement it exists for. The other way round, on a ticket recorded by phone you may still change everything else.

Only an agent or an administrator may set the channel. For the requester it would be a statement about their own case — and the reporting would depend on everybody being honest.

“E-mail” requires a connected mailbox, which is part of the Professional edition. The other three channels exist in both editions.

The part of the form with status, priority and the open list of the “How the request came in” field, framed in red.
When creating a ticket the channel sits between priority and observers. Only “Phone” and “Entered by an agent” are on offer.Open image at full size
The “Actions” card of a ticket, the “How the request came in” field reads “Phone” and is framed in red.
On the ticket the channel sits on the “Actions” card — here a case an agent recorded after a phone call.Open image at full size
10

Choosing the columns of the ticket list

Everyone puts together their own ticket list. For this, the “Columns” button sits next to “Filter”. It opens the “Choose columns” dialog.

In the dialog you tick every column you want to see. The arrows next to it set the order. “#” and “Title” are always included. You change the width of a column in the list itself by dragging the edge of its header.

“Save” stores your choice with your user account. It therefore applies on every computer and stays after you sign out. “Default columns” restores the list to its factory setting.

When there is not enough room for all columns, the ones on the far right drop out first. “#”, “Title” and “Status” always stay. So you move what matters most to you to the front.

With Professional, your custom fields are on offer as well. They appear in the dialog under their own name, here for example “Asset tag”.

Customers can set up their list the same way but are offered fewer columns. “Team”, “Created by”, “Last activity”, “Status changed at”, “Deadline”, “Follow-up” and “Time” are not available to them. Fields you have hidden from customers do not appear as a column either.

On a smartphone the button is not shown. There the list shows the columns that fit.

The ticket list with the columns #, Title, Status, Assigned, Priority, Category and Asset tag. The “Columns” button is framed in red.
“Assigned” comes right after the status here, “Follow-up” is switched off. “Created” is chosen as well but no longer fits the width.Open image at full size
The “Choose columns” dialog with a checkbox and arrows for each column and the buttons “Default columns”, “Cancel” and “Save”.
The chosen columns are at the top in their order, all others below.Open image at full size
11

Handing a ticket to another team

Professional only

Before you start: Both routes need a second team. The customer does not see the change in the history: for them it stays one case with one number, no matter how many teams worked on it. The new status “Open” after a handover is visible to them in the ticket header.

The ticket offers two buttons side by side for this, and the difference is printed underneath in small type. “Involve another team”: you stay responsible, the other team works alongside you in a linked ticket. “Escalate to another team”: the other team takes over.

When you hand over, responsibility moves without a second ticket coming into being. Your team keeps read access and may still comment, but can no longer change anything — which is exactly what the dialog tells you before you confirm. You pick the target team there and can add a reason.

When you involve a team, your ticket stays in your hands and gets a child ticket in the other team. Yours moves to the status “Waiting for other team”; once the other team closes theirs, yours comes back as “Back from other team”. So you do not have to ask whether anything happened over there. The child ticket’s attachments are copied into your ticket with the “Internal” badge, and the customer does not see them.

As for the classification: the categories of the handing-over team stay on the ticket, even when the new team does not have them at all — they show up there with their origin, greyed out. That way the new team can see what the case ran as so far, and re-sort it into its own list if needed.

Only whoever is responsible right now may hand a ticket on. An earlier station still sees the case but cannot pass it along a second time. It can comment, but it cannot take the ticket back to itself.

In your team’s list the ticket then shows “Waiting for other team” for as long as the other team is working on it. The “Also show tickets this team handed over” tick is on as a factory setting, and each user’s own choice is kept. For the other team the ticket starts as “Open”.

Whoever escalates becomes an observer of the ticket. The dialog says so before you confirm. As an observer you get an e-mail when the status changes, the ticket is closed or someone comments. Like any observer you remove yourself with “Stop observing”.

The two buttons “Involve another team” and “Escalate to another team” framed in red, with their explanations underneath.
Two routes, visibly separated: let someone work alongside you, or hand over. The difference is printed right at the button.Open image at full size
The “Escalate to another team?” dialog with the target team selection and the “Reason (optional)” field.
The dialog names the consequence before you confirm: no second ticket, read access stays, only the new team may change anything.Open image at full size
12

Custom fields

Professional only

When a piece of information is missing from your tickets — the asset tag, the end of the warranty, the cost centre — you add it yourself. Under “Settings → Ticket Settings”, at the bottom, sits the “Custom fields” card; the button is called “Add custom field”.

In the dialog you give a name and a field type: “Text”, “Multiline text”, “Integer”, “Decimal”, “Date” or “Yes / No”. The type decides what can be entered — a date field will not take “next week”, and that is exactly why you can report on it later.

Under “Scope” you decide where the field applies: “All teams (including new ones)” or “Selected teams only”. The first choice also covers teams that do not exist yet — the kind of difference you only notice half a year later.

The three switches under “Defaults” are “Mandatory by default”, “Hidden for customer by default” and “Not editable by customer by default”. They only apply to a field as long as nothing has been saved for that field in the field settings on the same page. Once you set it there, the field settings decide.

On the ticket the custom fields sit in a card of their own, “Additional information”, between the description and the comments. Without a template the form shows all custom fields of the team. If you pick a template when creating a ticket, it shows exactly the fields that template lists, in its order — “only the fields this case needs”.

A template can make a field mandatory on top of that. What the administrator hid from customers stays hidden, even when a template lists it. A mandatory field that a template does not list is not asked for, so that requirement does not apply to tickets created with this template.

How many custom fields a team may have is set under “Settings → General Settings” in the “Custom fields limit” card. You get rid of a field with “Deactivate”: it disappears from the form, but its values stay on the old tickets — the “Show deactivated” switch brings it back into the list.

The “Custom fields” card with three fields and the “Add custom field” button framed in red.
The list of custom fields lives under “Settings → Ticket Settings”, at the bottom of the page.Open image at full size
The “New custom field” dialog with name, field type, scope and the three defaults.
Name, field type, scope — a field needs no more than that. The three switches below are defaults.Open image at full size
The “Additional information” card on a ticket with the fields “Asset tag”, “Warranty until” and “Cost centre”.
This is how the agent sees the custom fields: a card of their own on the ticket, right below the description.Open image at full size
13

Observers

Sometimes somebody should follow a case without working on it: the team lead on a delicate matter, the colleague who takes over next week. That is what observers are for. On the ticket the “Observers” field sits on the “Actions” card, the button is called “Add observer”; the “Create new ticket” form has the same field. On the ticket a change there is saved with the “Save” in the “Details” card.

Only agents and administrators of the team the ticket belongs to can be picked. A customer cannot be an observer — they would otherwise receive mail about internal work.

An observer receives an e-mail when something happens on the ticket: a new comment, a changed status, a new assignment, changed fields. It is not sent immediately but bundled: after the last change the system waits a minute and then sends ONE mail covering everything that happened in that time. So working through a ticket in one go does not trigger seven mails. If several comments come in during that time, all of them are in the mail.

Who observes is part of the history: a change is recorded like any other, with the old and the new state.

Entering observers is part of Basic. The mail to observers is part of Professional, because it needs outgoing mail. Without it you can enter observers, but nothing goes out. An observer can remove themselves with the “Stop observing” button. That needs no right to change the ticket.

An observer is also added by itself: whoever hands a ticket on with “Escalate to another team” becomes an observer. That way they learn what the other team does with it.

The “Actions” card of a ticket with the “Observers” section framed in red: the “Add observer” button and one agent below it.
The observer sits on the “Actions” card. The ticket is assigned to nobody — observing and working on a ticket are two different things.Open image at full size
14

Working on the same ticket at the same time

When two people work on the same ticket at the same time, the later save could overwrite the earlier one, and nobody would notice. That is why the ticket shows who else has it open. It also refuses a save that is based on an outdated state.

The notice sits in the header of the ticket. “Marco Rossi is viewing this ticket” means that Marco has the ticket open. “Marco Rossi is actively editing this ticket” means that Marco has unsaved input on it. That can be a started reply, a comment being changed, the title or the description in edit mode, a follow-up, a custom field or a time entry. Changed fields in the “Actions” and “Details” cards count as well, as long as they have not been saved with “Save”. An open window on the ticket counts too. These are the windows “Involve another team?”, “Escalate to another team?”, “Close ticket”, “Resolve incident” and “Start a workflow”, plus the window for the comment on a status change. After two minutes without input there, the notice shows “viewing” again, even if the draft is still there.

If several colleagues have the ticket open, the notice sums them up, for example “Marco Rossi and 2 more are viewing this ticket”. Point at the notice to see all names. As soon as someone is actively editing, the line only counts the people who are editing. You never see yourself. If you have the ticket open in two tabs, you count once. If the ticket is only open in a hidden tab, you drop out of the others’ notice after about a minute.

When a colleague saves a change, the notice reads “Marco Rossi changed this ticket”, with the “Refresh” button next to it. A new comment from someone else shows “Marco Rossi added a comment”. If no person made the change, for example an automation rule or an incoming e-mail, the notice reads “This ticket was changed”. The notice stays until you refresh.

“Refresh” loads the current state of the ticket, such as status, assignment, fields and history. It does not reload the whole page. Your unsaved input stays. A started reply stays in the reply box, and an open title or description keeps your text. If the saved text has changed in the meantime, “The saved text has changed in the meantime.” appears below the field. If you save then, your text replaces the saved one. The “Refresh” button in the header of the ticket does the same.

If you save on an outdated state anyway, the save is refused. The window “Ticket changed in the meantime” opens. If a person made the change, it names them. Your change has not been saved. Click “Refresh”, check your change against the current state and save again. This applies to every change to the ticket itself, for example status, assignment, priority, the “Details” card and custom fields.

Comments are never refused. Two replies do not overwrite each other. Both end up on the ticket. The same applies to attachments and time entries. Bulk actions on the ticket list and automation rules are not checked against the state either. They change the ticket directly. Whoever has it open sees the notice afterwards.

Customers see none of this. They do not appear in the notice. They also do not see who is working on their ticket.

Who has a ticket open is only held in the server’s memory. About a minute after the person has left the ticket, the entry is gone. None of it is written to a log. The ticket stores who changed it last. That entry is part of the data export for that person. When the person is anonymized, it is removed.

More on this in the card: Data export for one person, Anonymize people

The header of a ticket with the notice “Marco Rossi is actively editing this ticket” below the title, framed in red.
The notice sits below the title of the ticket. Here Marco Rossi has unsaved input.Open image at full size
The header of a ticket with the notice “Marco Rossi changed this ticket” and the “Refresh” button next to it, framed in red.
Marco Rossi saved while the ticket was open. “Refresh” loads the current state.Open image at full size
The “Ticket changed in the meantime” window naming Marco Rossi, with the “Refresh” button framed in red.
This window appears when you save on an outdated state. Your change has not been saved.Open image at full size
15

Tickets from e-mail, replies and follow-ups

Professional only

Before you start: With Google/Gmail you need an app password (which requires two-factor sign-in); Google rejects ordinary account credentials. Microsoft 365 does not work at all right now: basic authentication for IMAP is switched off there, and app passwords do not help either.

The mail channel is one road with two directions, and they belong together: an incoming mail turns into a ticket, your reply goes out as mail, and the requester’s answer lands as a comment on the same ticket — not on a second one.

The matching is not done by feel: a reply only lands on the existing ticket when the mail carries the case’s reference in its subject or brings the reply headers of the mail program with it. A mail with neither starts a new case — better one ticket too many than two unrelated cases merged just because the subject happened to match.

Everything for it sits under “Settings → E-Mail Settings”. The upper card, “SMTP settings”, is the way out: host, port, “Use SSL”, user and password, plus the sender address and sender name. With “Send test e-mail” you send yourself a sample — save first, then test, as the card says itself.

The “IMAP settings” card is the way in: host, port, the poll interval and the two folders. You do not have to guess the folder name: “Read from server” fetches the folders that actually exist in your mailbox, “Create on server” creates a new one. The field then takes the path your mail server uses for it — one server writes “INBOX/Processed”, the next one “INBOX.Processed”, and both mean the same thing.

The “Processed folder” takes the mails the system sets aside: mails from blocked senders, automatically generated mails, and mails a workflow moves with “Move to folder” without a folder of its own. Leave it empty and they stay in the inbox. Below that you set when the cleanup runs (“Hour”, “Minute”) and how old a message may get (“Retention (days)”) — otherwise the mailbox quietly keeps growing.

Mailboxes belong to the team, not to the system: under “Team mailboxes” each team enters its own address with a password. That address is at the same time the sender of that team’s mails — so the requester replies to the same place the mail is collected from.

And now the part without which none of this happens: the workflow. A configured mailbox on its own does nothing at all. If a team has no enabled workflow, the mailbox is not even polled — no ticket, no confirmation, the mails just sit there. The automatic reply to your customers exists only here, and you set it up yourself. That is on purpose: a system that writes to every sender address unasked would be worse than one that stays quiet.

Under “E-Mail workflows” you pick the team at the top and create a workflow with “+ Add workflow”. It gets a name (for you only), an “Enabled” switch and two statements about when it applies: “Match” decides whether all conditions must be true (“All conditions”) or one is enough, and “Stop after match” ends the run as soon as this workflow has matched — a workflow further down never gets its turn then. You change the order with the arrows next to it.

Under “When?” sits the condition itself. “Every e-mail in this mailbox” takes every mail; “Only when subject or text contains” requires a word in the subject or the body. “Advanced” makes it precise: there you choose what is looked at — “Subject or body”, “Subject”, “Body”, “Sender (From)” or “Recipient (To/Cc)” — and how it is compared: “Contains”, “Equals” or “Regex”. That is how you separate, say, reports to a shared address from everything else.

Below that sit five actions as switches. They are the actual content of the workflow — whatever is not switched on does not happen:

“Create or append ticket” turns the mail into a ticket — or appends it as a comment to an existing one when the reference is in the subject. Without this action a mail never becomes a case.

“Set fields” sets priority, status, main and sub category, owning team and assignee right when the ticket is created. Everything left on “— Keep default —” stays as it would be without a workflow.

“Auto-reply” is the confirmation to the sender. With this switch off your customer gets no confirmation, no matter how well everything else is set up. “Send mail” can write to the sender as well, as the next action shows.

“Send mail” sends an additional mail: either to the sender of the incoming mail or to selected team members and fixed addresses. It has its own “Send conditions” — leave them empty and it goes out on every run of this workflow.

“Move to folder” files the processed mail into a folder. Leave the field empty and the general “Processed folder” from the IMAP settings above applies.

The “Auto-reply” action in detail: you build the subject from blocks. “Original subject {originalSubject}” takes over the subject of the incoming mail, “Ticket reference {ticketTag}” inserts the case reference — together they produce something like “Printer problem [TICKET-99-a1b2c3]”.

The reference is not added by itself. It appears only where you put {ticketTag}. {ticketId} only inserts the bare number, and the system does not recognise a reply by it. Without the reference in the subject, a reply is still matched if it carries the reply headers of the confirmation. Only a mail with neither becomes a new ticket.

The text below it is your confirmation message. Write it in English: it runs through the same export/import as every other text, and only that way can it be translated into the other languages. Leave it empty and the system sends its own default message. The same placeholders are allowed here as well.

“Reply language” decides which language the subject and the text go out in: “Standard English” uses English, “Fixed language” a language you pick, “Assigned agent's language” the language of the assigned agent, and “Team default language” the team’s default. The translations themselves are maintained on the languages page.

One piece of advice that the system prints above the card as well: everything belonging to one case belongs in ONE workflow. Only actions inside the same workflow know the ticket that was just created — that is why the confirmation can name its number and an action from a second workflow cannot.

The whole mail channel — in and out — is part of the Professional edition. In Basic the system neither sends nor receives e-mail; tickets are created there through the portal, the phone and the agent.

The “SMTP settings” card with host, port, user, password, sender address and the “Send test e-mail” button.
The way out. Every field carries its explanation below it — the ports 587 and 465 are named there explicitly.Open image at full size
The “IMAP settings” card with the “Read from server” and “Create on server” buttons framed in red.
Do not type the folder, fetch it: “Read from server” lists the real folders, “Create on server” creates a new one below the inbox.Open image at full size
The “Team mailboxes” section with the mailboxes of the Helpdesk and Network teams, the addresses framed in red.
One mailbox per team. The address is also the sender — which is why it lives here and not in the general settings.Open image at full size
A workflow with its name, “Match”, “Stop after match”, the condition under “When?” and the five action switches framed in red.
The five actions are framed in red. In this example “Create or append ticket”, “Auto-reply” and “Move to folder” are on — “Set fields” and “Send mail” are off. Without a workflow like this the mailbox is not polled at all.Open image at full size
The “Auto-reply” action with the subject field framed in red, the building blocks, the English text and the reply language choice.
The subject holds the blocks “{originalSubject} {ticketTag}” — that is what the system recognises the customer’s reply by later. Below it the text and the reply language, here the assigned agent’s.Open image at full size

Agent status (availability)

Every agent shows whether they are available right now, and when you assign a ticket the state stands next to the name. Everything in this block is part of Basic. The automatic distribution that skips absent agents is a separate feature and part of Professional.

1

Available, busy, away

Every agent has one of three states and sets it themselves, in the user menu at the bottom left of the sidebar. The three entries sit under the heading “Availability”.

A dot shows the state. “Available” carries a green dot, “Busy” an amber one, “Away” an empty ring.

The three differ not only in colour but also in the fill, so somebody who has trouble telling colours apart still sees the difference.

Your own dot sits on your account picture at the bottom left, so you do not have to open the menu to see it.

When you assign a ticket, the state stands behind the name. If an end of the absence has been recorded, it stands there too.

An agent who is not available stays selectable and is only marked as such. Whether the ticket goes to them anyway is your decision.

You are only ever offered the agents of the team the ticket belongs to.

Only agents and administrators have a state. A customer does not have one.

More on this in the card: Assign several tickets to one agent at once

The user menu in the sidebar with the three states “Available”, “Busy” and “Away” and a tick on the current one.
The agent’s own user menu. The three states stand at the very top, the one in force carries a tick. The same dot sits on the account picture below.Open image at full size
The “Assign to” picker on a ticket, opened, with the agents of the team and the mark “Away until” on one entry.
The red frame sits on the entry of Lena Chen. Behind the name stand her state and the end of the absence. She stays selectable. Only the agents of the team the ticket belongs to are offered.Open image at full size
2

Sickness and holidays are entered by an administrator

Somebody who is ill rarely signs off first. That is why an administrator can set the state for another person, in the edit form of the account under “User management”.

The form has two fields for this. “Availability” holds the state, “Away until” holds the end of the absence.

The second field only appears with “Away”. There is no end to enter for “Busy” or “Available”.

Without a date the absence lasts until somebody ends it. With a date it ends on its own. The hint below the field says so: “Leave empty for an absence without a set end.”

A date in the past is not accepted. It would have expired immediately, and your colleague would still be standing in the list as available.

Both fields only appear for agents and administrators. If you set the role to “Customer” in the same form, they disappear.

One field carries both. A day of sickness and three weeks of holiday are the same thing to the system, with a different date.

The edit form of an account with the fields “Availability” set to “Away” and “Away until” holding a date.
The red frames sit on the two fields. They stand at the very bottom of the form, and only for agents and administrators.Open image at full size
3

“Busy” resets itself after one hour

“Busy” lasts one hour. After that the agent is available again without having to do anything. Saving the user form does not extend “Busy”.

The menu shows the remaining time next to the state, for example “60 min left”.

The hour is fixed. It is a safety net against forgetting, not a rule of operation. Anyone who is unavailable for longer picks “Away”.

The reset is a point in time, not a job. The account holds the moment the state ends, and the state is worked out when somebody reads it. If the server was off during that hour, the agent is simply available again afterwards. No backlog is left for a background service to catch up on.

“Away” only expires if an end has been recorded. Without one it stays until somebody changes it.

When agents set themselves to “Away”, they cannot enter an end. Only an administrator hands out an end date. If one is already set, it stays when the agent picks “Away” again.

The user menu with the state “Busy”, the remaining time “60 min left” and the tick next to it.
The red frame sits on the state in force. The tick stands on the right, the remaining time next to the state. The dot on the account picture is amber now.Open image at full size
4

No availability history and no per-person evaluation

The system only remembers which state is in force right now. It does not record who was busy or away and when.

That is why the user list shows the state as of now and nothing more. There is no column with a history and no report on attendance.

This is a decision, not a missing piece. Availability data per person is behavioural data, and in many companies the works council has a say in it.

A history is not needed either. The state answers a single question: is this colleague available right now? “Busy” ends by itself after an hour.

How many tickets an agent has is something you see in the ticket list, where “Assigned to” filters by one person. How long somebody was away is written down nowhere.

The user list with each agent’s state right after the name and the columns Name, Email, Team, Role and Actions.
The red frames sit on two of the three agents who are not available. The list shows the state as of now. There is no column with a history.Open image at full size

Automatic ticket assignment

A new ticket can be given an owner right away. The system uses the availability explained in the block before, the distribution is switched on per team, and it is off as a factory setting. This whole block is part of Professional.

1

The distribution belongs to the team

Professional only

Without a distribution every new ticket lands in the pool. Somebody has to take it or somebody has to hand it out, and both work as long as somebody is watching.

Switch the distribution on and every new ticket is given an owner as it is created. That happens immediately and not a few minutes later. A ticket that is created directly as resolved or closed is not distributed.

The setting sits on the team under “Settings → Teams” and each team decides for itself. One team can distribute while the team next to it works out of the pool.

As a factory setting every team stands on “Off”. An existing environment does not change its behaviour just because the feature exists.

Tickets go to the members of the team. An administrator who works in the queue and is a member of that team receives tickets just like an agent.

The “Automatic assignment” section in the Helpdesk team dialog, set to “Round robin”, with two explaining sentences below it.
The setting sits on the team. Below the field one sentence explains the chosen procedure, and below that stands who gets skipped.Open image at full size
The open selection field with its three entries “Off”, “Round robin” and “Least load”.
Three entries to choose from. “Off” is the factory setting.Open image at full size
2

Round robin or least load

Professional only

There are two procedures and you choose one per team.

“Round robin” goes around in turn. The new ticket goes to the available agent whose last automatic assignment is longest ago, so somebody who has just joined the team is first in line.

“Least load” looks at the desk. The new ticket goes to the available agent with the fewest open tickets.

A ticket that waits for the requester counts half. Somebody with many open questions is not busy in the same way as somebody with a pile of fresh incidents.

A resolved or closed ticket does not count at all any more. That is true for a status you created yourself as well, as long as it is marked as resolved or closed.

The result can be worked out in both procedures. When two agents are level the same rule always decides, never chance.

The same section in the network team dialog, set to “Least load”, with the sentence about tickets counting half.
The same field on a different team, here on “Least load”. The sentence below changes with the setting.Open image at full size
3

Whoever is not there gets nothing

Professional only

Before every assignment the distribution asks for the state of the agent. “Busy” and “Away” are skipped.

Locked and deleted accounts are out of the question as well, and so is anybody who is not a member of the team the ticket belongs to.

If nobody is available the ticket stays without an owner, and creating it still goes through normally.

That is deliberate. Everybody sees a ticket in the pool, and nobody sees a ticket that sits with somebody who is away.

The ticket history carries the reason: it reads “Nobody available” instead of a name.

More on this in the card: Available, busy or away

The history of a ticket with an “Auto-assignment” entry that names “Nobody available” instead of a person.
Nobody was available and the ticket stayed in the pool. The red frame sits on the entry that names the reason.Open image at full size
4

What the distribution touches and what it does not

Professional only

The distribution works on every path a ticket comes into being on, and that includes tickets from the e-mail inbox. The exception is a group incident: it stays with whoever created it.

It works the same way on the sub-tickets of a request: each one is distributed inside the team that receives it.

A ticket a person has assigned is never touched by the distribution. If you pick an owner yourself while creating a ticket, your choice stands.

Every automatic assignment is recorded in the ticket history, with “Auto-assignment” as the author and the name of the agent next to it.

The agent receives the same mail as with an assignment by hand. If the ticket still stands on “Open” it moves to “Assigned”.

More on this in the card: An e-mail becomes a ticket

The history of a ticket with two “Auto-assignment” entries: the assignment to an agent of the team and the status change from “Open” to “Assigned”.
The history names the automation. It assigned the ticket and moved the status along with it.Open image at full size
5

The report on the distribution

Professional only

Anybody running an automation has to be able to check what it does. There is a card of its own on the report page for that.

Two numbers stand at the top. On the left how many tickets the automation handed out, on the right how often nobody was available.

Under “Nobody available”, after “Most recent:”, stand up to 20 tickets it last happened to, and one click takes you there.

Below that stands one line per agent with their number and their availability. The lines come from the membership of the team.

A line with a zero is therefore not an error. It is what the table is for.

Somebody who has stood on “Away” for weeks has received no tickets and is still listed, with the reason next to the zero.

This card is a log of the machine and not a rating of people. There is no availability history and no report on who was present for how long.

Agents only see their own teams here, and only those whose “Agent Permissions” allow seeing reports. Without a team filter they see the first of those teams.

More on this in the card: No availability history, no per-person evaluation

The report page with the “Automatic assignment” card among the other reports.
The card sits on the report page. The red frame shows where to find it.Open image at full size
The “Nobody available” box with its number, an explaining sentence and the most recent ticket it happened to.
The second number stands next to the first with the same weight. Below it stands the most recent ticket that stayed in the pool.Open image at full size
The report table with six agents, their numbers and their availability, including one line with a zero and an “Away” note.
One line per agent. The red frame sits on the line with the zero that carries its reason next to it.Open image at full size

Requests with tasks & approval

Some requests are not a single ticket. A request creates its tasks when it is filed, each as its own ticket in the team that handles it, and approvals are possible but not mandatory. This whole block is part of Professional.

1

A request creates its own tasks

Professional only

“A new colleague is starting” is not a single ticket. It is a notebook, two accounts, a phone extension and perhaps access from outside. Each piece belongs to a different team, and you still want one case that tells you where things stand.

That is what a request is for. It is a ticket that creates its tasks the moment it is filed, and each task becomes a ticket of its own in the team that handles it.

A request is not a second thing to maintain. It lives on a ticket template: under “Settings → Request workflows” you find every ticket template, and you attach the tasks to one of them.

For each task you fill in a few fields. “Task” is the name the requester reads, “Handled by” is the team that gets it, and “Ticket title” and “What the team has to do” fill the ticket that comes out of it.

Several tasks may point at the same team. That team then gets several tickets, not one ticket with a list inside it.

A task without a team is not offered at all. The field says so itself: “Not assigned yet — this task is not offered”. That way you can save a plan that is not finished yet.

Above the tasks stands a sentence that sums up the whole plan: what is created as a factory setting, how much the requester may change, and who releases it. Change a setting and the sentence rewrites itself.

In front of “Ticket title” stands the fixed text “Parent ticket title -”. The new ticket starts with the title of the request, followed by your title, for example “New colleague in accounting - Set up notebook and docking station”. That way the specialist team sees which request a task belongs to. If you leave the field empty, the name of the task follows instead.

“Main category” and “Subcategory” prefill the category of the new ticket. You only get the categories of the team in “Handled by”, because that is where the ticket is created. If you change the team, both fields are cleared. You set both or neither, and if they stay empty the ticket is created without a category.

The name of the request stands above the tasks. Use the pencil next to it to rename it. The name belongs to the ticket template, so it also changes under “Settings → Templates” and in the new-ticket form.

The list of ticket templates under “Request workflows”, each with its number of tasks and an “Edit tasks” button.
Every ticket template in one place, each showing how many tasks it carries. The red frame sits on the way into the plan.Open image at full size
The plan with the name of the request, the pencil for renaming, the summary sentence and the first task.
At the top the name of the request, with the red frame on the pencil for renaming. Below it stands the sentence that sums up the plan, and then the tasks follow.Open image at full size
The first task with “Handled by” set to Helpdesk, the category Notebook and New request, and the fixed text “Parent ticket title -” in front of the ticket title.
The categories come from the team in “Handled by”. The title of the request always stands in front of the ticket title.Open image at full size
2

The requester ticks what they need

Professional only

When somebody picks the template in the new-ticket form, the box “What is needed?” appears with one line to tick per task.

There are three kinds, set per task. “Selectable, off by default” starts empty, “Selectable, on by default” starts ticked and can be unticked, and “Always — cannot be deselected” always runs.

A task that always runs is still shown, marked “(always included)”. The requester should see what happens anyway.

Below the box you read what will come of it: “Each selected item becomes its own ticket for the team that handles it.”

A customer can file a request too, as long as the template is released to customers. The switch for that sits on the template.

The customer then sees only their own request. The tickets in the specialist teams stay hidden from them, even though their request created them — those tickets carry credentials and internal notes. Their internal notes do not show up in the history of the request either. When a specialist team closes its ticket, its attachments are copied into the request with the “Internal” badge, and the customer neither sees nor downloads them.

If a request arrives by e-mail, it becomes an ordinary ticket. You then start the workflow afterwards. The button “Start workflow” in the header of the ticket does that.

In the dialog you pick the matching template under “Template”. Below it you get the same box “What is needed?” as in the new-ticket form. Tick what the request asks for.

Under “Title” you adjust the title of the ticket. The titles of the tasks start with it. Below that you find the additional fields of the template. Enter the details from the request there. Mandatory fields carry a star.

With “Start” the tasks are created just as for a request from the form. If the template needs an approval, the ticket and its tasks stay locked until it is given.

Only one workflow can be started per ticket. After that the button disappears. It is also missing on closed tickets and on tickets that are a task themselves. Anyone who may work on the ticket can start it.

More on this in the card: Ticket templates can be released to customers, one by one

The “What is needed?” box in the new-ticket form with four tasks to tick.
The box in the requester’s new-ticket form. The first line always runs and cannot be unticked, the second is ticked as a factory setting, and below them stands what each tick will become.Open image at full size
The dialog “Start a workflow” on a ticket with the template, the tasks to tick and the title field.
The dialog on a ticket. The first task always runs. Below the title field you read what the tasks will be called.Open image at full size
3

Progress on the request

Professional only

On the request itself the tasks are listed under “Workflow tasks”, with the count next to it, for example “1 of 4 done”.

Each row shows the name of the task, the number of its ticket, the team and the assignee, and the name is a link into that ticket.

“Done” comes from the status of the ticket, not from a separate tick. Whatever counts as closed in the ticket list counts as done here — two ways of counting the same thing would drift apart sooner or later.

The block only appears on a request. An ordinary ticket does not show it.

When a specialist team closes its ticket, its “Closing comment” arrives in the request. It stands there as an internal note, and its first line names the number and the name of the task. The customer does not see this note.

Credentials and everything the agent of the request should pass on belong in the closing comment. All other comments of the specialist team stay in its own ticket. If the team closes without a comment, no note is created.

The “Workflow tasks” block on the request with four tasks, their ticket numbers and teams.
The red frame sits on the row with the count. Below it, each task shows which ticket and which team it sits in; the tick on the left comes from the status.Open image at full size
An internal note on the request: the header “Task #… (Notebook and docking station) was closed with this note:” and below it the closing comment of the specialist team.
The helpdesk closed the task with a closing comment. On the request it stands as an internal note with the “Internal” badge.Open image at full size
4

One approval for the whole request

Professional only

An approval covers the whole request, not each single task. Eight applications are one mail to the manager, not eight.

You set this up under “Approvals” in the same plan, and the sentence above it states the rule: “One approval covers the whole request. Add a second stage only when single tasks need their own release.” Each stage has five fields: “Name” is the name of the stage, “Covers” says what it applies to, “Decided by” says where the approver comes from, “Approver” holds the person, and “Remind after (hours)” sets the reminder.

The approver needs no account in the ticket system: you enter an e-mail address and they decide over a link. A manager who approves twice a quarter therefore costs no agent seat.

The mail contains exactly one link to a page. There are deliberately no approve or reject buttons in the mail itself: a virus scanner that opens every link would otherwise approve.

The page carries the name of the stage as its heading. It shows the number and title of the request, the requester, and under “This decision covers” the tasks this decision is about, with a comment field and the two buttons below.

The link does not last forever, and the page names the deadline: “Please decide by …”. It is valid for 14 days. After that the page only says that the link is invalid or has expired, and an administrator sends the request out again with “Reassign”.

A decision cannot be taken back, and afterwards the page says so: “A decision cannot be changed.”

The “Approvals” section of the plan with two stages, each with a name, an address and a reminder.
Two stages on one plan: the first covers the whole request, the second only the tasks that point at it. The approver is an address, not an account.Open image at full size
The approval mail in the mailbox with a single link to the decision page.
This is how the request reaches the approver. The mail holds one link and nothing else to click; the decision happens on the page behind it.Open image at full size
The decision page for the stage “Head of IT” with the request, the requester, the task covered, the comment field and the “Approve” and “Reject” buttons.
The decision page. “This decision covers” says what it is about. The approver is not signed in and has no account.Open image at full size
5

A second stage for single tasks

Professional only

Some tasks need a release of their own. Access from outside is not the same thing as a notebook.

For that you add a second stage and pick it on the task under “Extra approval”. While it says “None — the request approval is enough”, the release of the request is all that is needed. Both stages are asked at the same time, not one after the other. A stage is only asked if one of the chosen tasks concerns it. The stage for the whole request is always asked.

A task is released once every stage that concerns it has agreed. A task without a stage of its own starts right away, unless the stage for the whole request is still waiting. Then it starts as soon as the request is approved.

Until then the task is locked. Its ticket sits on “Waiting for approval” and has no assignee. Instead of status buttons the card reads “This ticket is waiting for approval and cannot be worked on yet.” No route gives it an assignee before then.

The lock also holds for bulk actions on the ticket list. Select such a ticket there and you read the reason: “This ticket is waiting for approval and cannot be worked on yet.”

The ticket is still created immediately, so the specialist team sees what is coming and nobody has to keep an eye on the request.

The actions card of a locked task with the status “Waiting for approval” and the note that the task cannot be worked on yet.
The task that is waiting for its own stage. The red frame sits on the current status. Above it the card says why no status can be chosen.Open image at full size
6

A reminder, but no release by time

Professional only

You can set a reminder per stage, given in hours.

If no answer comes, the same mail goes out again after that time, carrying the same link as the first one. Anyone who kept the first mail can still use it.

Without a reminder the request simply waits, without asking again.

What does not exist is a release by expiry. Below the field it says so in as many words: “A request is never approved automatically. If nobody reacts, it keeps waiting.” A deadline that agrees on its own would not be an approval, it would be a formality.

One approval stage with the reminder field, given in hours, framed in red.
The reminder belongs to the stage and is given in hours. Leave it empty and the system does not ask again.Open image at full size
7

A rejection reaches the requester with its reason

Professional only

Rejecting requires a reason. Without a text the page does not accept the rejection.

The field says where the text goes: “Comment (required when you reject — the requester will see it)”. An internal note does not belong here.

The requester receives an e-mail with the reason and does not have to ask why nothing is moving.

Approving needs no reason. It is the expected outcome.

If only a second stage rejects, the refusal concerns only that stage’s tasks. The rest of the request carries on.

A rejected task gets the status “Rejected” and counts as finished, so the request does not hang forever on something that will never arrive.

Once the request is rejected, the other approvers receive no more mails. Their link then reads “This request has already been rejected. Your decision is no longer needed.” In the list on the ticket their stage shows “No longer needed: the request was rejected.”

The decision page after the rejection, with “You rejected this request.” and the note that a decision cannot be changed.
After the decision: the page confirms what the approver did and says that it stands.Open image at full size
8

The audit trail and the approver on holiday

Professional only

On the request, “Approvals” shows one row per stage with the approver, the state, and for an open request how long it has been waiting.

After the decision the row shows when it was made and with which comment. That is the audit trail, and it stays with the case.

If the approver is on holiday, an administrator moves the request to another address. The button is called “Reassign” and only appears while the request is open.

Only an administrator may do this. An agent who could reassign would be able to reassign to themselves and then decide.

Reassigning creates a new link, and the old one dies immediately — even if somebody forwarded it.

The move itself appears in the same list: who moved it, when, from whom to whom.

Nobody can decide in somebody else’s name. The link is the only route, and who received it is recorded on the case.

The “Reassign” dialog asking for the new address, with the field filled in.
The dialog asks for the address the request should go to instead. You confirm with the same word that opened it.Open image at full size
The “Approvals” list with the approved first stage, the rejected second stage, both comments and the note about the reassignment.
Both stages with their decision, their time and their comment. The red frame sits on the stage that was moved, and below it stands who moved it from whom to whom.Open image at full size

Reply & ticket templates

Two kinds of template for two moments: a reply template fills the comment editor on an open ticket, a ticket template fills the new-ticket form. Both are part of Basic. Only sending a reply as e-mail depends on the mail channel and therefore on Professional — the template itself does not.

1

Reply templates: text + field actions (status, assignment, priority …) in one pick

Before you start: Managing and applying are two different rights. Administrators and agents can do both out of the box. Applying is open to anyone who may work on the ticket. The actions of a template also need the right to steer the ticket, so a team that had the ticket earlier may comment but cannot run actions. Even if a role cannot manage the settings, it can still apply a template.

Templates live under “Settings → Templates”. The line below the heading says what they do and what they do not: “Reply templates fill the comment editor and suggest field actions. Nothing is sent automatically.” A template is a prepared move, not a machine — you always send it yourself.

There are two kinds and you pick one when you create it: “Add reply template” for the answer on an open ticket, “Add ticket template” for the new-ticket form. The kind cannot be changed later, because it decides which fields the form shows at all. The badge above each template tells you which one you are looking at: blue “Reply template”, green “Ticket template”.

A reply template is made of the answer text (“Reply text”), the “Internal note” checkbox and any number of actions. There are six actions: “Set the status”, “Set the priority”, “Assign to a user”, “Remove the assignee”, “Hand over to another team” and “Set a follow-up”.

The “Assign to a user” list starts with the entry “The agent who applies it”. Take that one when several people share the template: the ticket then belongs to whoever applied it, not to one fixed person from the list. “Set a follow-up” asks for an amount and a unit (minutes, hours, days, business minutes, business hours, business days) plus the note that will later tell you why the ticket is back.

The blue box at the end of every template writes down in one sentence what it will do — for example “Inserts the text as a public comment, sets status to Waiting for Service Provider Response, assigns to the applying agent, sets a follow-up in 3 days.” The sentence rebuilds itself while you edit. It is your counter-check: if it says something other than what you intended, one setting is wrong.

Text is not required. “Hand this over to the network team without writing a word” is a valid template — the sentence then reads “Suggests actions without a reply text”. The “Set the status” action follows the same rules as a status change by hand. Applied to several tickets at once, the template skips locked tickets and names the reason.

The “Close ticket” window offers reply templates as well, in the “Template” field. It only lists templates whose active “Set the status” action sets a status that counts as resolved or closed. Internal templates are not offered there. If you pick one, the window takes over its text as the comment. If the template sends a mail and the window offers mail sending, it only takes over the recipient if that is “Requester” or a fixed address. The other actions and the attachments of the template do not run there. The ticket is closed as usual.

The “Templates” page with the red-framed “Add reply template” and “Add ticket template” buttons.
The kind is chosen when you create it: two buttons instead of a switch. Below them the templates lie open — each with its badge and its scope.Open image at full size
The three action rows of a reply template, red-framed, with the blue plain-text sentence below.
Three actions on one template: status, assignment to whoever applies it, follow-up in three days. The sentence below says the same thing in one piece.Open image at full size
2

Suggested actions individually deselectable before sending

On an open ticket the “Template” button sits above the comment editor. A click opens the type-ahead search (“Search templates…”), picking one fills the comment editor. Nothing else happens, and the line below says so: “Nothing happens until you add the comment.”

Every action of the template becomes a chip next to the button — in plain words, not in jargon: “sets status to Waiting for Service Provider Response”, “assigns to the applying agent”, “sets a follow-up in 3 days”. Clicking a chip strikes it through: it is deselected and will not run. Another click brings it back.

Deselected actions are struck through, not removed. That keeps visible what the template would have suggested — and it keeps the decision reversible for as long as you have not sent.

Which chips start out active is decided by the template: in the settings every action carries a “Suggested” switch. That switch is the proposal for every case; the chip on the ticket is the decision for this one.

The “×” behind the chips removes the template again. The text stays in the editor — you may well have rewritten it already; only the effect goes away, meaning actions, mail and attachments.

You send with the usual comment button. Only then is the comment created, and only after that do the actions that are still active run.

The comment editor of a ticket with the applied template, three chips beside it, the last one struck through, and the inserted text below.
Two actions will run, the third is deselected: the follow-up in three days does not fit this case, the rest does. The text sits in the editor and can still be changed.Open image at full size
3

Placeholders (requester, ticket number, title …) – inserting the template puts the real values into the text

The answer text may use five placeholders; the list sits below the field: “{requesterName}, {ticketId}, {ticketTitle}, {ticketRef}, {agentName}”. Write them with curly braces, exactly as they appear there.

“{ticketRef}” is the ticket reference in the shape “[TICKET-8-…]”. It is how the system recognises a customer’s answer when it comes back by e-mail. “{ticketId}”, in contrast, is just the bare number.

They are resolved when the template is APPLIED, not when it is saved: the settings page keeps showing “{requesterName}”, the comment editor on the ticket shows the real name. The reason is a practical one — resolving on save would burn the values of ONE ticket into the template for good.

That way you read the finished text before anything leaves the company. If the salutation does not fit, you change it in the editor like any other text.

Who counts as the “requester” is decided by the ticket, not by the account: the requester recorded on the ticket comes before the account that filed it. If an agent files a ticket for a colleague after a phone call, the answer still greets the colleague and not the agent.

A mistyped placeholder is rejected when you save, and it is named: “Reply text: unknown placeholders {requesterNam}. Available here: {requesterName}, {ticketId}, {ticketTitle}, {ticketRef}, {agentName}.” So you notice it while writing the template, not on a customer.

The e-mail subject has its OWN, shorter list (“{originalSubject}, {ticketTag}, {ticketId}”) — which is why it is printed there a second time. “{ticketRef}” works there as well and means the same as “{ticketTag}”. “{requesterName}”, “{ticketTitle}” and “{agentName}” do not work in the subject and are rejected just the same.

The “Reply text” field of a template with placeholders in the text, red-framed, and the list of allowed placeholders below it.
This is how the template looks in the settings: with the placeholders, not with values. The line below lists which ones exist.Open image at full size
The same template applied on a ticket: the comment editor holds the name, the title and the ticket reference spelled out.
The same text on the ticket: “Hello Amir Khan”, the ticket’s title, the reference “[TICKET-8-…]” — and, as the signature, the agent who inserted the template. Nothing has been sent yet.Open image at full size
4

Reply optionally sent as e-mail to the requester

Professional only

Before you start: The mail channel as a whole is Professional — inbound as well as outbound. On top of that, the team’s mailbox must have sending on ticket actions switched on. If it does not, the mail chip is not offered on the ticket at all; the template’s actions run as always, only the mail is dropped. There is no warning about it either.

The “Send the comment as e-mail” switch turns the comment into the mail as well. There is deliberately no second text field for it: what stands in the ticket is what the customer reads — two texts would drift apart sooner or later.

Under “Recipient” you choose between “Requester”, “Assignee”, “Observers” and “Fixed address”. Who the requester is gets resolved by the server when the template is applied — a template does not know the ticket yet. The mail inbox account itself is never written to; that would be a message to ourselves. If the “User” field holds a name without an address, no mail goes to the requester. It is not sent to whoever recorded the ticket instead either.

The subject may carry “{originalSubject}”, “{ticketTag}” and “{ticketId}”. Keep “{ticketTag}” in there: that reference is how the system recognises the customer’s answer and appends it to the same ticket. Without it, every reply becomes a new ticket.

The mail goes out as plain text. Bold, lists and links are stripped before sending, otherwise the customer would read the raw markup. Inside the ticket the comment keeps its formatting.

On the ticket the mail is one more chip next to the actions (“E-mail to Requester”) and just as deselectable as they are. So a template never sends anything without you having seen it. The chip only appears when the team’s mailbox sends ticket action mails.

A template’s attachments (“Attachments”) are its own copies of the files. Applying the template adds them to the TICKET, with their own row in the history — they are not part of the mail. Carrying attachments on a template needs no Professional licence; only sending does. A template with the “Internal note” tick adds no files.

The mail block of a template with the red-framed “Send the comment as e-mail” switch, the recipient and the subject.
Switch, recipient and subject. The subject holds “{ticketTag}” — the reference by which the customer’s answer is recognised.Open image at full size
5

Create a template straight from an existing ticket

Most templates are not born at a drawing board but in the moment you write the same answer for the second time. That is why every comment on a ticket carries a small sheet icon on the right, labelled “Make template”. It takes exactly that comment as the starting text — a colleague’s comment as well. Only people who may manage templates see the icon.

If the ticket has attachments, a dialog first asks which ones should come along: “Tick only the attachments the template should carry — one of them may be a customer’s screenshot. Nothing is ticked by default.” Nothing is pre-ticked, and that is on purpose.

After that you land on the templates page with a draft that is NOT saved yet. At the top sits the amber banner “Draft from ticket #… — name it and review the text (it may contain customer details), then save.” The name is empty: you have to give one, otherwise it will not save.

What is carried over: the text, the “Internal note” checkbox, the ticket’s team, and the ticket’s state as a suggestion — its status and its priority are already sitting there as two actions. What is not carried over: requester, address and title. Those belong to this one case.

Read the text before you save. It comes from a real case and may hold a person’s name, an order number or a room. Nothing is anonymised for you — the banner says so, but doing it is your job.

Only “Save” creates the template; the ticked attachments are then copied over and confirmed with a message.

A comment on a ticket with the red-framed “Make template” sheet icon next to the edit and delete buttons.
The path starts at the comment, not in the settings: the sheet icon on the right of the answer you want to reuse.Open image at full size
The “Make a template from this comment” dialog with the ticket’s two attachments, neither of them ticked.
Two attachments hang on this ticket, neither is ticked. One of them is the customer’s own screenshot — that does not belong in a library of stock answers.Open image at full size
6

Drafts stay private until published; scoped per team or global

“Applies to” decides who gets offered the template: one particular team or “All teams”. A new template starts with a concrete team — “All teams” is a choice somebody has to make, not a silent default.

On a ticket you are offered the templates of the owning team plus the global ones. If the ticket moves to another team after a hand-over, the list moves with it — the new team’s templates are what you can pick from.

The “Draft” switch turns the template into your workshop: “Only you can see this template until you publish it.” Somebody else’s draft appears in no list and cannot be reached by its address either — not even by administrators. A new template starts as a draft; only when you switch that off and save do the others see it.

Two templates may not share a name if they can meet: a global one collides with any template of the same name, in any team. A reply template and a ticket template may share a name, though — they never appear side by side in the same list.

“Duplicate” makes a copy, and the copy is always a draft: “Duplicated. The copy is a draft only you can see.” That is the comfortable way to a variant without anyone else being offered the half-finished version.

The head of a template with the “Reply template” and “Draft” badges, the red-framed “Applies to” field and the equally framed “Draft” switch.
This template belongs to the helpdesk and is a draft. Nobody but its author sees it.Open image at full size
7

Ticket templates: new-ticket form prefilled (title, description, category, priority, team)

A ticket template fills the “Create new ticket” form. It has no answer text, no actions and no mail — at this moment there is no ticket for anything to act on. The form therefore shows different fields than for a reply template, and the green frame tells you that you are looking at a ticket template.

You can prefill “Ticket title”, “Owning team of the new ticket”, “Main category”, “Subcategory”, “Priority” and the “Ticket description”. Every field may stay “Not prefilled” — whatever stays empty is filled in later by whoever uses the form.

Watch the difference between the two team fields: “Applies to” at the top says WHO sees the template. “Owning team of the new ticket” says WHERE the new ticket goes. Those are two different questions, and they may have different answers.

The categories are grouped by team, because a category belongs to a team. If you pick one from another team, the form tells you and saving is refused: on the target team’s new-ticket form that category would not be on offer at all, so the prefill would come to nothing.

There are no placeholders here, and the hint below the text says so: “No placeholders here: the template only prefills the form, nothing is resolved or sent.” A “{requesterName}” would end up literally in the new ticket — which is why it is refused at save time.

The blue box sums up what the template does here as well: “Prefills the new ticket with title ‘New notebook for a colleague’ · category Notebook / New request · priority Medium · team Helpdesk · the description.”

On the form itself you pick the template with the “Template” button; next to it stands “Prefills the form - nothing is created until you submit.” Everything prefilled can still be changed, and nothing is created until you submit.

One example template is shipped with the system: “Example: create accounts for a new colleague”. It shows the shape of the thing and does nothing on its own — rebuild it or delete it.

The editor of a ticket template with the red-framed fields for title, target team, category and priority.
Five prefills plus the description. The “Owning team of the new ticket” field is not the scope above it — it says where the ticket goes.Open image at full size
The “Create new ticket” form after picking a template: the “Template” button and the prefilled title are framed in red.
The same form as always, only already filled in: title, team and priority are there. Category and description follow further down the same page.Open image at full size
8

Ticket templates can be released to customers per template

The “Offer this template to customers” switch is off out of the box. The hint next to it says both things you need to know: “Customers can pick this template when they create a ticket. A draft stays hidden either way.”

Why it is off by default: a template is often named in internal vocabulary and written for colleagues. Making it visible to customers is a statement to the outside world — somebody should make it deliberately, not by accident.

The customer sees the same “Template” button above the new-ticket form, but only the released templates. A draft stays hidden even with the switch on — the two rules sit one behind the other, not side by side.

The point is not convenience, it is the first contact: a request that arrives complete saves the round of questions that would otherwise cost two days. Put those questions into the template’s description — the customer answers them while creating the ticket.

You can go further with “Fields to ask for”. The template then decides which custom fields the form asks for, in which order, and which of them are required. That selection REPLACES the usual fields of the team, it does not add to them. That is exactly its purpose. Custom fields themselves are part of Professional; their card is called “Custom fields”. Releasing a template to customers works in every edition.

A field that is hidden from customers stays hidden, even if a template lists it. The field selection is a tool for order and for cut, not a way around the field settings.

The red-framed “Offer this template to customers” switch with its hint text.
One switch per template — here it is on, so this template is offered to customers. The hint says outright that a draft stays hidden regardless. Below it sits the field selection.Open image at full size
The new-ticket form as a customer sees it, with the template list open and the released templates in it.
The same list on the customer’s side: it holds only the released templates. The other ticket templates of this installation do not appear here.Open image at full size
9

Every use traceable in the ticket history

Every use that does more than insert text writes ONE entry into the history, under the field name “Template”. It names the template. The actions that ran write rows of their own. Without it there would be no way to explain later why a ticket suddenly jumped to “In Progress”: the individual actions do write their own rows, but none of them names the template.

The picture reads: “Template ‘First reply: we have your ticket’ applied”. What the template did stands in the rows of its own actions, such as the change of status.

Deselected actions are not in it: they did not happen. A failure is in it, and it is named as one, behind the word “failed”. A plain text template without actions, mail or attachments leaves no “Template” entry on a single ticket. It only inserted text. Applied to several tickets at once, the entry is always written, together with the internal “Bulk” row.

The entry is INTERNAL — the requester does not see it. A template’s name is internal vocabulary (“standard rejection”), and the history is open to the ticket’s creator as well. The field changes themselves stay visible to them; only their origin in a template does not.

The author is the agent, not “system” and not the template. That is deliberate: applying it was their decision. Unlike an automation rule, what stands on the ticket here is a person.

The history of a ticket with the red-framed “Template” entry naming the applied template, and the rows of its actions.
One entry per use, with the agent as its author. Every action that ran writes a row of its own. The template entry says where they came from.Open image at full size

Automation & follow-ups

Two ways to the same goal: no case is left lying around because nobody has it on their mind any more. A follow-up is something you set yourself — that is part of Basic. The rules do it without you, and they are part of Professional.

1

Follow-up on a ticket by hand (date + note, filters Today/This week/Overdue)

Before you start: Only agents and administrators see the follow-up, and the ticket says so: “Only agents and administrators see this — the requester never does.” The requester never gets to see it.

The follow-up sits on the ticket in the “Details” card on the right, below the deadlines. As long as none is set it says “No follow-up set.” with a “Set follow-up” button. You pick a date and time (“Date and time”) and add a note (“Note (optional)”, placeholder “Why is this coming back?”). After that the buttons read “Change” and “Remove”.

The note is where the value is. In two weeks a date alone will not tell you why this ticket is back on your desk. That is also why the note hangs on the date: remove the date and the note goes with it — a reason without a date is something nobody would ever see again.

Above the ticket list sits a “Follow-up:” row with four buttons — “No filter”, “Today”, “This week” and “Overdue” — and the list itself has a “Follow-up” column. It deliberately does not live inside the collapsed filter block: this is the question an agent starts the day with.

“Overdue” includes today’s. Otherwise a follow-up would disappear on exactly the day it counts — the moment its time of day has passed.

The “Details” card of a ticket with the red-framed “Follow-up” section, holding the “Overdue” badge, the note and the “Change” and “Remove” buttons.
This ticket’s date is in the past, hence the red “Overdue” badge. The note says why the ticket comes back.Open image at full size
The ticket list with the red-framed “Follow-up:” row above the table and the equally framed “Follow-up” column.
Three tickets on this page carry a date. The buttons above narrow the list down to today, this week or overdue.Open image at full size
2

Time-based rules – reacting to the ABSENCE of an action

Professional only

Before you start: A new rule is ALWAYS created switched off — even if you try to create it switched on through the interface. A rule that runs over your entire backlog the moment it is created is the accident the system takes off your hands here. It only goes live with the next “Save”.

The rules live under “Settings → Automation”. The line below the heading says what this is about: “Rules that act when nobody else does.” A rule belongs to a team and works on that team’s tickets; the “Team” selector at the top decides which rules you are looking at.

The difference to everything else in the system: these rules do not react to an event, they react to its ABSENCE. No reply from the requester for three days, no movement for a week, created four hours ago and still nobody’s job — there is no click that triggers any of this. Which is exactly why nobody notices it.

A notice with a green tick at the top tells you that checks are running: “The automation checks every minute. 2 of 6 rule(s) are enabled.” With no rule enabled you get the warning “No rule is enabled. Nothing is being checked and tickets behave exactly as before.” — and then nothing really happens.

A rule looks at all tickets of its team, however many there are. In one pass it acts on at most 500 of them. The rest follow in the next pass.

A rule that was switched off does not catch up. When you switch it on again, it does not act on what became due during the pause. Rules without a time condition are the exception: they do catch up. The first time a rule is switched on, it acts on everything its preview shows.

The top of the “Automation” page with the red-framed notice about the check interval, the team filter and the “Add rule” button.
Six rules are stored here, two of them run. The four bundled examples sit below on the same page, all switched off.Open image at full size
3

WHEN/IF/THEN rule builder with a live plain-English sentence

Professional only

A rule has three blocks. “WHEN” is the absence it reacts to (“Something has not happened for a while. This is what the automation reacts to.”). “IF” narrows down which tickets that applies to (“Which tickets it applies to.”) — by status, priority, team, category, assignee or rating. “THEN” is what happens.

Above the blocks the rule stands there as one sentence, and it rewrites itself with every change: “When a ticket has seen no activity for more than 5 minutes and has the priority “High”, then set a follow-up in 4 hours.” If something is still missing, the sentence says so in that very spot instead of hiding it.

In the “IF” block you also decide how the conditions combine: “All conditions must apply” or “Any condition is enough”. The sentence above changes its shape accordingly — with an “and” it would otherwise claim the opposite of what the rule does.

Two fields control how several rules work together: “Order” sets the sequence, and the switch “Skip the following rules for a ticket this rule applies to” stops every later rule for a ticket this one applies to.

A new rule starts with the time condition “Time without any activity” “longer than” 3 “days” in the “WHEN” block. Change or remove it if your rule needs something else.

More on this in the card: A poor rating as a trigger

A rule with the red-framed plain-English sentence above it and the three blocks WHEN, IF and THEN below.
The same content twice: once as a form, once as a sentence. Reading the sentence, you notice immediately when you have set up something other than what you meant.Open image at full size
4

Four example rules included (switched off on installation, enable whichever you like)

Professional only

Every installation ships with four rules: “Example: remind the requester after 3 business days”, “Example: close after 10 days without a reply”, “Example: raise the priority of unassigned tickets” and “Example: follow up on tickets nobody touched for a week”. They sit one below the other on the “Automation” page.

All four are switched off — each carries the “Off” badge and “Last run: never”. They are a starting point to read and rebuild, not behaviour somebody slipped past you. Rename them, change them, switch them on or delete them.

They also apply to “Every team” — the only place in the system where that happens without an explicit choice. So before you switch one on, check whether it really is meant for all of your teams.

The first of the four example rules with the red-framed “Off” badge, its name and the plain-English sentence.
This is what the first one looks like; the other three sit below on the same page and are switched off as well. “Every team” means: it would apply to each of your teams.Open image at full size
5

Preview before you switch it on: shows which tickets the rule would affect right now – without changing anything

Professional only

Below every rule sits the button “Which tickets would this affect?” One click shows the list “Tickets this rule would affect right now” — the tickets the rule applies to at this moment, with number and title.

Below it says what the preview does not do: “The preview only reads. It changes nothing and writes no log entry. Unsaved changes are not included.” That last part matters: the preview works on the saved rule, not on what is currently in the form.

If the rule matches nothing at the moment, it says so too: “No ticket matches this rule right now.” That is the answer you want before switching it on — not afterwards on your customers’ tickets.

The opened preview of a rule with the heading “Tickets this rule would affect right now”, two tickets and the red-framed hint that the preview only reads.
This rule would touch two tickets right now. The hint below says that none of it happened when you clicked the button.Open image at full size
6

Actions: e-mail, status, priority, assign, hand over to another team, set a follow-up

Professional only

Before you start: The “Send an e-mail” action goes out through the same mail channel as the rest of the system. Without a configured outgoing mail nothing happens — and a Basic installation does not have that channel at all. The history only records the mail when it really went out. Otherwise the run shows “Failed” in the rule’s log, with the reason.

In the “THEN” block you pick from seven actions: “Send an e-mail”, “Set the status”, “Set the priority”, “Assign to a user”, “Remove the assignee”, “Hand over to another team” and “Set a follow-up”. “Add action” adds more; each has its own “Active” switch, so you can silence a single one without switching off the whole rule.

For “Send an e-mail” you tick the recipients one by one: “the requester”, “the assignee”, “the observers” and “a fixed address” — the last one with its own field for the address. For “Set a follow-up” you give a number, a unit and the note that will later sit on the ticket.

For “Hand over to another team” the hint sits right below it: “The ticket moves to that team and the current assignee is cleared. No second ticket is created.” So no duplicate appears — the same case simply changes hands.

A rule cannot close a ticket that is waiting for an approval, nor an incident that still has open reports.

The “THEN” block of a rule with the red-framed action selector and the fields for number, unit and note of the follow-up.
One action with its extras: “Set a follow-up”, 4 “hours”, plus the note the agent will later read on the ticket.Open image at full size
7

Time spans selectable per condition: in business hours and business days from the team calendar – or running around the clock

Professional only

Every time condition in the “WHEN” block has three parts: the kind, the comparison “longer than” and a number with a unit. There are five kinds: “Time since the ticket was created”, “Time without any activity”, “Time without a reply from the requester”, “Time without a public reply from an agent” and “Time without a status change”.

The unit decides how the time is counted — and it does so per condition: “minutes”, “hours” and “days” run through, at night and at the weekend too. “business minutes”, “business hours” and “business days” count against the team’s business-hours calendar, so only what falls inside opening hours is counted.

In everyday use the difference is big: three days are three days, whereas three business days counted from a Thursday in a Mon–Fri week land on the following Tuesday. A business day is a working day in the calendar of the team the ticket belongs to, even for a rule for “Every team”. Public holidays do not count. If the time starts outside opening hours, it counts from the next start of work. The “Set a follow-up” action counts “business days” the same way.

A time condition in the “WHEN” block with the number and unit framed in red, next to the selector for the kind of condition.
This condition counts in “business days” — three business days by the team’s calendar, not three calendar days.Open image at full size
8

Log per rule + the rule name as the author in the ticket history

Professional only

Below every rule sits a “Log” button. It opens the table “What this rule did” with one row per affected ticket: “When”, “Ticket”, “Cycle”, “Result” and “Details”. “Details” holds what exactly was done, for example “Set a follow-up: 01.10.2026 22:36”. If a rule has done nothing yet, it says so: “This rule has not done anything yet.”

The “Cycle” column is the reason a rule does not shout at you every minute: it acts on a ticket once per cycle. A cycle only ends when the rule no longer applies to that ticket — so if the customer replies and then goes quiet again, cycle 2 begins and the rule acts again.

On the ticket itself the rule appears as the author. In the history it shows up under its own name with an “Automation:” prefix, for example “Automation: High priority: bring it back to us”. So on every case you can look up whether a human or a rule acted — and if it was a rule, which one. Customers see “System” as the author instead of the rule’s name.

The header line of every rule also carries “Last run:” with the time of its last pass, or “never” for a rule that has never run.

The opened “What this rule did” table with three rows and the red-framed “Cycle” and “Details” columns.
Three passes on two tickets: on the unanswered ticket #4 the rule acted a second time — hence the “2” in the “Cycle” column. “Details” holds the follow-up date that was set each time.Open image at full size
The history of a ticket with two red-framed rows whose author is “Automation: High priority: bring it back to us”.
The same event seen from the ticket: date and note appear as two rows in the history, with the rule as their author.Open image at full size

Bulk actions on the ticket list

Tick several tickets and change them in one go. All of it is part of Basic. Only the customer e-mail of a template depends on the mail channel and therefore on Professional. The real point is not the number of tickets but the honest handling of a partial result: every rule applies to the single ticket, so the system says beforehand how many the action fits, and afterwards which ones did not come along and why.

1

Change the status of several tickets at once

The ticket list has a column of checkboxes on the far left. It is there for administrators and agents. A customer never sees it.

The checkbox in the header row selects every row of the page you are looking at. It does not select the whole result set. If you need more than that, narrow the filter — a filter is the more honest way to state a quantity than a checkbox that also covers tickets you cannot see.

The selection clears as soon as you page, filter, search or switch team. That way no selection travels along that is no longer on screen.

The list in the picture does not show every ticket. At the top right, next to “Filter”, stands the word “active”, and beside it “Reset”: closed tickets are hidden, because a bulk action is aimed at cases that are still running. A selection always covers only what the list is showing at that moment.

From the first tick onwards a bar appears above the list. It shows “20 selected”, next to it “Clear selection” and the buttons “Change status”, “Assign”, “Assign to me” and “Apply template”. Further right sit “Multiple report” and “Group into incident” — those two belong to duplicate reports and are explained in the next block.

“Change status” opens a small dialog. You pick the target status, and the line below immediately says how many of the selected tickets it applies to.

If the target status requires a comment, a text box appears. Below it stands how many tickets the text goes to. It goes to every changed ticket, not just to the first one.

Not every status appears in the list. System statuses are missing because nobody sets them by hand. “Waiting for other team” is missing as well: that status creates a sub-ticket for a target team, and you choose that team per ticket. In a bundle there would be only one single input for it.

A ticket without an assignee is assigned to you when you change its status on the detail page. In a bundle that does not happen: “close 30 tickets” would otherwise quietly mean “30 tickets assigned to me” and 30 e-mails.

This dialog changes nothing else. Priority, category and everything beyond it are set in a bundle through a reply template.

More on this in the card: A second stage for single tasks

The ticket list with ticked rows and the bar above it showing the number of selected tickets and the bulk action buttons.
The red frame sits on the bar that only appears with the first tick. On the left the number of selected tickets, on the right the actions.Open image at full size
The “Change status” dialog with a chosen target status and the line stating its reach.
The target status is chosen; below it the reach and the reason for every ticket that will not come along. Both stand there before you click “Apply”.Open image at full size
2

Assign several tickets to one agent at once

“Assign” opens the list of agents. Agents who are away stay selectable and are only marked as such, exactly as on a single ticket.

“Assign to me” is the same dialog with your own name preselected. It is a shortcut, not a second route, and the same rules apply to it.

An assignment can send an e-mail to the agent. That needs Professional and the team’s “Send assignment e-mails” switch. Mails on self-assignment are off by default. The dialog states the number beforehand: “This sends 11 e-mail(s) to the selected agent.” Eleven tickets are eleven mails.

The agent has to belong to the team of that particular ticket. A selection spanning two teams therefore cannot be handed to one person in one piece. That is not a limitation of the bulk action — the same rule applies on a single ticket.

An assignment cannot be reset to “nobody”. That does not exist on a single ticket, so it does not exist in a bundle either.

The “Assign” dialog with the chosen agent, the reach and the notice about the number of e-mails.
Below the picker stand the reach and the number of e-mails. The box beneath names every ticket that will not come along, with its reason. Some already belong to Marco Rossi, the others belong to a team he is not part of.Open image at full size
3

Apply a reply template to several tickets, placeholders resolved per ticket

“Apply template” applies a reply template to all selected tickets. Each ticket gets the same comment it would get if you applied the template by hand.

The list offers the templates of every team that occurs in the selection. A template appears as soon as it fits at least one selected ticket; how many it really fits is what the preview says next.

The server resolves the placeholders per ticket, so every customer gets their own salutation and their own ticket number. The note in the dialog says so as well.

The field actions of the template run along, and its attachments are copied to every ticket.

In a bundle all actions of the template run. You can deselect individual ones only on a single ticket; if you do not want an action, use a template without it.

If there is no template for the teams in the selection, the dialog says so: “No reply template is available for the teams of the selected tickets.”

The “Apply template” dialog with a chosen template and the note that placeholders are resolved per ticket.
The red frame sits on the note about the placeholders — what separates this from one text worded the same for everybody. Below it stands the reason the template fits 14 of the 20 tickets: six of them belong to a team it is not offered for.Open image at full size
4

Preview before running, result afterwards, skipped tickets stay selected

All three dialogs show the same line before anything happens: “Applies to 19 of 20 selected ticket(s)”.

Below it stands the box “Will be skipped” with one line per ticket that does not come along, each naming the ticket number and the reason. So you read before the click why the number is smaller than your selection.

After running it says “19 changed, 1 skipped” and the same box turns into “Not changed”. The content is the same; it has only stopped being a forecast and become a statement.

The reasons are those of the single ticket. A ticket is already in the target status. The transition is not allowed from its current status. It belongs to a team you are not responsible for. The chosen agent is not part of its team. It is waiting for an approval. It is a group incident with open reports. It is a parent ticket with an open sub-ticket.

The skipped tickets stay selected, the changed ones do not. A second attempt with a different target is therefore one click away, and nobody has to guess which ones are still open.

The preview is a second opinion, not a permit. When the action runs, the server checks every ticket again — a ticket can change between the display and the click.

One call accepts at most 200 tickets. With 20 rows per page that is far away.

The dialog after running: the number of changed and skipped tickets, and below it the “Not changed” box with the reasons.
The “Not changed” box names the reason per ticket. Here one ticket is still waiting for approval.Open image at full size
5

The e-mail to the requesters is off by default

Professional only

A checkbox for sending mail appears only for templates that send one, and only if the mail channel is open. It is empty by default, so a bulk action writes nothing to the outside world until you tick it.

If the channel is closed, the reason takes the place of the checkbox: either e-mail sending is switched off, or the mailboxes of the selected teams do not send ticket action mails. You read that before the click, not afterwards in the result.

Once you tick it, an amber notice appears with the number: “This sends 20 e-mail(s) to customers.” The number comes from the preview and is the number of tickets the template really fits.

Changing the status and assigning never write to customers. The assignment does send an e-mail, but to the agent. Applying a template in a bundle is the only route on which a customer mail comes into being.

Sending depends on the mail channel and therefore on Professional. If it is off, no mail goes out and the history mentions no mail either — it never claims a delivery that did not happen.

The “Apply template” dialog with the mail checkbox ticked and the amber notice about the number of customer mails.
The checkbox is ticked and the amber notice states the number of mails. Without the tick none goes out.Open image at full size
6

Every bulk change appears in the history of the individual ticket

Every change made by a bulk action appears in the history of the individual ticket. It looks like any other change there, with an old and a new value.

The requester sees these rows as well. For them a status change is the same event whether it was triggered singly or in a bundle — hiding it would not be more discreet, only worse.

A bulk assignment writes the row with the new assignee. For a ticket that stood on “Open”, a second row follows with the status, because the assigned ticket then moves to “Assigned”.

On top of that comes an internal row carrying the reference of the run. That reference lets you find all tickets of the same run later on. The requester does not see this row.

Every row names the person who triggered the bulk action.

A skipped ticket gets no entry, not even one about the attempt. What did not happen does not appear in the history.

The history of a ticket with the assignment row and the internal row below it naming the bulk run.
The newest row is on top. Below the rows about time and cost centre stand the status, the assignment and the reference of the run. The red frame sits on the internal row, the one the requester does not see.Open image at full size

Multiple reports & outages

Two situations look alike and are not. If the same person reports the same thing twice, one report should disappear. If many people report one outage, none may disappear. Each has its own route, and the difference is the requester.

1

Merge two reports from the same person

Tick the rows in the ticket list and click “Multiple report”. The button becomes usable from two ticked rows onwards.

The dialog asks first: “Which ticket stays?” The oldest ticket is preselected, so the deadline runs from the requester’s first contact instead of their second attempt. You can pick a different one.

Below it stands the direction with both numbers: “#11 will be closed and moved into #10.” So before the click it is clear which ticket stays.

Everything comes along: comments, attachments and the description of the second report. The description becomes a comment on the original, with its original author and its date. The dialog states the numbers beforehand.

Recorded time is moved, not copied. Otherwise the same effort would sit on two tickets and be billed twice.

The second report is not deleted. It is closed and points to the original from then on, and its number stays valid.

The requester does not get a separate e-mail. They are on the original and see everything there. The closed report carries a comment naming the original, which they can read.

There is no undo. That is why everything stands in the dialog before you click “Merge”.

Afterwards the history of both tickets records who merged what and when.

The ticket list with three ticked rows and the bar above it holding the “Multiple report” and “Group into incident” buttons.
The red frames sit on the two buttons. They stand side by side and mean two different things. In rows 12 to 14 you can also see the marker of the running incident.Open image at full size
The “Multiple report for the same issue” dialog with the choice of the ticket that stays and the summary.
The red frame sits on the direction. It names both numbers so nobody has to guess which ticket disappears.Open image at full size
The ticket list, searched down to two tickets: the original and the merged report, which is closed.
The search holds a word from both titles, so the original and the report stand next to each other. The red frame sits on the merged report. It is closed and still stands in the list, with a reference to the ticket it was moved into.Open image at full size
2

Replies to the old ticket number still arrive

Professional only

Before you start: This needs the e-mail inbox. Without it there is no reply by e-mail that would have to be routed.

The requester has the old ticket number in their mailbox. They know nothing about two reports having been merged and reply to the mail they have.

That reply lands in the original. The system follows the reference the closed report carries.

That is why a merged report is never deleted. Without it the reference would not exist and the reply would arrive nowhere.

Whoever took part in the old report may also write on the original. The check happens on the ticket named in the mail.

The closed report with the reference to the original and the comment the requester reads there.
The red frames sit on the reference in the card on the right and on the comment. This reference is what a reply by e-mail follows.Open image at full size
3

Reports from different people cannot be merged

If you select tickets from different people, the dialog does not take them along. It names every rejected row and its reason before you click.

The reason reads: “Different requester — this is an incident, not a multiple report.” It also tells you where to go instead.

This is the most important guard of the whole function. If you merged thirty reports from thirty people, twenty-nine of them would lose their ticket and never hear back.

Who the requester is is decided first by the e-mail address on the ticket. If there is none, a foreign name in the “User” field decides, and the same name counts as the same person. Otherwise the account that created the ticket counts.

This is why the guard also holds for phone calls. If an agent records two calls, both tickets were created by them. Different callers still stay different callers, because their names are in the field.

If the requester cannot be determined on one side, it is rejected as well. Unknown is not the same as the same person.

More reasons appear in the same box. An incident cannot be merged. A closed original takes nothing more. And a report that already has reports of its own does not come along, so no chains are formed.

The “Cannot be merged” box in the dialog, with the ticket number and the reason.
The red frame sits on the reason. Ticket 15 belongs to a different person, so it stays out. The other two tickets are merged all the same.Open image at full size
4

Bundle many reports about one outage under a single incident

Professional only

When the file server goes down, twenty people report it. Every one of these reports is a case of its own with its own requester. Merging would be wrong here, because nineteen people would lose their ticket.

Tick the reports and click “Group into incident”. The dialog offers three routes: add them to an incident that is already open, declare one of the selected tickets to be the incident, or create a new incident with its own title.

If the team already has an open incident, that route is preselected. It is the more common one: the outage is long known, only new reports keep coming in.

Every linked ticket keeps its requester, its status and its own deadline. Nothing disappears. The incident only bundles the answer.

All reports of one incident have to belong to the same team. If an outage affects two teams, each gets its own incident. Otherwise one team’s resolution would empty the other team’s queue.

You can also attach latecomers on the single ticket. If the team has an open incident, a hint appears at the top with “Assign” and “Not related”. The system never attaches anything by itself: a wrongly attached ticket would get a resolution that does not concern it, and would be closed along the way.

The incident ticket states how many reports are attached to it. Linked tickets in turn carry the number of their incident, in the list and in the card on the right.

“Resolve incident” closes the incident and answers all reports at once. The resolution text is mandatory: it is the entire point of the function, because it goes to everyone affected.

Every linked ticket gets the text as a public comment, is set to the chosen status, and its requester receives their own e-mail. No group mail, because that would expose the addresses of everyone affected.

The message afterwards states how many tickets were closed and how many requesters were notified. Both numbers stand apart, because a ticket without a reachable address gets a comment and a status but no e-mail.

A ticket you answered and closed yourself in the meantime stays untouched. It is not closed a second time and not written to again.

As long as open reports hang on an incident, it cannot be closed through the normal status change. Otherwise twenty people would silently be left without an answer.

The “Group into incident” dialog with the three routes and the open incident including its number of linked tickets.
The red frame sits on the open incident, with the number of reports already attached to it on the right. Above the routes stands the sentence that separates this case from merging: nothing disappears.Open image at full size
The hint bar on a single ticket with the open incident and the “Assign” and “Not related” buttons.
The red frame sits on the hint bar. It is a suggestion, not an action: clicking it away changes nothing on the ticket.Open image at full size
The incident ticket with the number of linked reports, the “Resolve incident” button and the checkbox for the banner.
The red frames sit on the button that resolves, on the checkbox for the banner and on the number of linked reports.Open image at full size
The “Resolve incident” dialog with the closing status and the resolution text entered.
The red frame sits on the note above the field. It says where this one text goes: to every linked ticket and to every requester.Open image at full size
The report of one affected person after resolving: resolved, with the resolution text as a public comment.
The red frame sits on the answer. It stands on this one requester’s ticket, with their number and their history. The same answer stands on every other affected person’s ticket.Open image at full size
5

The incident as a banner and as a note in the automatic reply

Professional only

The dialog and the incident ticket both carry the checkbox “Also show as a banner on the sign-in page”. With it everyone learns about the outage before writing another ticket.

The banner stands on the sign-in page and inside the system once signed in. It names “Known incident” and the title of the incident, so that title is a text for customers.

If several notices are active, they stand below one another. Maintenance announced for Saturday does not push away today’s outage, and the other way round.

If somebody creates a new ticket anyway, the automatic reply names the incident. That holds for a ticket that is already linked and for every new ticket of that team, as long as the incident is open and announced. This needs outgoing e-mail.

Once the incident is resolved the banner disappears by itself. Nobody has to remember to switch it off again.

On the “Maintenance and incident notices” page you can see which incident is running as a banner right now. The switch on that page belongs to planned maintenance and does not apply to incidents.

The incident ticket with the checkbox ticked and the banner that appears at the bottom as a result.
The red frame sits on the checkbox. It takes effect at once: the notice runs along the bottom, on every page of the system.Open image at full size
The sign-in page with the running incident banner between the logo and the sign-in form.
The red frame sits on the banner. It is there before signing in, so it also reaches whoever only wants to check whether they need to write a ticket.Open image at full size
The incident ticket after resolving: resolved, with the resolution text as a comment.
The red frame sits on the resolution text. With this closure the banner is gone as well.Open image at full size

SLA, calendar & escalations

Deadlines that match your opening hours: a policy says how quickly you have to reply and to solve, a calendar says when the clock runs at all. Everything in this block is part of Professional.

1

SLA policies with deadlines for first response and resolution

Professional only

Before you start: Without an active policy the system measures nothing — no deadline, no column, no mail. And clocks are created when a ticket is CREATED: whatever came in before you switched the policy on gets no deadline backdated. That is on purpose — otherwise a thousand old tickets would stand there as breached the next morning.

You set up deadlines under “Settings → SLA”. The page itself tells you at the top when no policy is active. A policy has three parts: a name, the conditions and the targets. New policies are deliberately created inactive — so you can finish setting them up before they do anything.

The conditions are “Team”, “Priority”, “Main category” and “Subcategory”. Empty means “Any”, that is “applies to everything” — not “applies to nothing”. If several policies match, the one with the lowest number under “Order” wins; that is why the narrow policy sits at the top and the general one below it.

The two category fields are grouped by team, because categories belong to a team — but you are offered all of them, including those of other teams. That is deliberate: on a handover the ticket moves, the category does not. A ticket the helpdesk handed to the network team still carries the helpdesk’s classification, and a policy may point at exactly that. Once you pick a main category, the field below only offers the subcategories linked to it — a pair that cannot exist on a ticket is rejected on saving.

Every policy has two targets. “Time to first response” ends with the first public reply by an agent — an automatic acknowledgement and an internal note explicitly do not count. “Time to resolution” ends as soon as the ticket reaches a status that counts as resolved (which one that is, you set under “Settings → General → Status”). Both targets have their own minutes, their own calendar and their own reaction to a breach.

On the ticket the deadlines sit on the right in the “Details” card, below them “Show deadline history”: a log that records every step — started, paused, resumed, met, missed — each with a reason and the working time used. Only agents and administrators see it; for customers it cannot be retrieved.

If somebody changes the priority or the team later, the clock switches to the policy that matches then: the working time used so far is settled with the old calendar, after that the new values apply. If no policy matches any more, the clock ends without a verdict — it counts neither as met nor as breached.

If no policy matched when the ticket was created, the clock starts the first time a policy matches after a change, for example a higher priority. It counts from that moment. The clock for the first response only starts if nobody has replied yet.

New clocks only come into being when a ticket is reopened. Other status changes create no new clocks.

An SLA policy with name, order, active switch, the four red-framed conditions Team, Priority, Main category and Subcategory and the two targets below.
The policy applies to every team, but only to the “High” priority. Below it the two targets: 15 minutes to the first reply, 240 to the resolution.Open image at full size
The deadlines of a ticket: “Time to first response” with the “In time” badge, below it “Time to resolution” with remaining time and the opened deadline history.
The first reply came in time, the resolution is still running. The log names the reason for every step. Read from the bottom up: started, recalculated with “ticket fields changed”, and finally met with the first public reply.Open image at full size
2

Business-hours calendar per team

Professional only

A calendar says when the clock runs. It has a name, its own time zone and any number of windows per weekday — a lunch break is simply a day with two windows. A window may run past midnight; then “ends next day” appears beside it.

Which calendar applies to a team is set on the team (“Settings → Teams”). On the individual target of a policy you can override it: “From the team” takes the team’s one, or you pick another. That is exactly what produces the usual case — faults count around the clock, everything else only during office hours.

What is counted is the time that actually passes inside the window, not the difference between the clock readings. At the daylight-saving switch that makes a difference: a 24/7 day in October has 25 hours, a night shift from 22:00 to 06:00 in spring seven instead of eight. An office window from 09:00 to 17:00 is never affected, because in the EU the switch happens at night.

If no calendar with open hours can be found, no deadline is created — better none than a guessed one. On the ticket a note appears instead of a date.

The “Helpdesk business hours” calendar with the red-framed Europe/Berlin time zone, the Monday-to-Friday 09:00–17:00 windows and the “Add opening hours” button.
Five days, one window per day. The time zone belongs to the calendar, not to the server — a second location simply gets a second calendar.Open image at full size
3

Public holidays via .ics import or entered by hand

Professional only

Before you start: We do not ship any holiday data. Public holidays depend on the LOCATION, not on the language — 16 German states, 26 Swiss cantons, 50 US states, and new every year. A shipped list would be wrong at some point without anybody noticing. Take the official .ics file of your region; that is a one-minute job per year.

Below every calendar sits the “Closed days” list. A click on “Import holidays (.ics)” takes a calendar file and afterwards reports four numbers: how many days were taken over, how many replaced, how many unreadable and how many were already there. You can also enter single days by hand.

The ↻ symbol behind a day means “repeats annually”. It is only correct for fixed dates: 3 October falls on the same date every year, Good Friday and Whit Monday hang on the date of Easter and move. Moving holidays therefore stand in the list with their concrete date per year — in the picture “Good Friday” without the symbol.

A closed day swallows the whole window of that day, including the part that reaches into the next day. And when a calendar knows no closed day at all for the next twelve months, the page says so explicitly — otherwise the system silently counts through public holidays and produces wrong deadlines.

The red-framed “Import holidays (.ics)” button and below it the equally framed list of closed days.
Five closed days. Four carry the ↻ symbol for “same date every year”, Good Friday does not — it moves.Open image at full size
The “Around the clock” calendar with the red-framed amber note that it knows no closed days for the next twelve months.
The note is not an error but a warning: this calendar counts through every public holiday. For an on-call calendar that is exactly right.Open image at full size
4

The clock pauses while waiting for the requester

Professional only

The most common argument about deadlines is this one: the ticket has been waiting three days for the customer’s answer, and the clock keeps running anyway. That is why every target has the “Pause while waiting for the requester” switch — individually, not for the whole policy.

Whether you are waiting is decided by the status: under “Settings → General → Status” every status carries a mark for whether it counts as “waiting for the requester”. With the switch on, the deadline rests while the ticket sits in such a status. The wall clock keeps running — that is why the list shows “Paused” instead of a remaining time, and the deadline history holds “Paused” and “Resumed” with their times. The waiting time does not count either if the ticket is resolved straight out of such a status.

For the first response you usually leave the switch off: you owe the first reply regardless of what is being waited for. For the resolution it is usually on. The picture shows exactly that setting.

The two targets of a policy with the red-framed “Pause while waiting for the requester” switches — off on the first target, on on the second.
The same switch, two answers: the clock for the first reply runs through, the one for the resolution rests while it is the customer’s turn.Open image at full size
5

Time remaining in the ticket list, with a filter for breached deadlines

Professional only

As soon as a policy is active, the ticket list gets the “Deadline” column. It shows the remaining time of the next open deadline (“14h 53m”). Once no deadline on the ticket is running any more, the verdict stands there: the “In time” badge for a met one, the red “Breached” for a missed one. A ticket without any clock gets a neutral dash, and that is deliberate: a ticket from before the policy is not a failure.

If no policy is active the column is missing entirely — it does not stand there empty. The same holds for the filter: under “Filter” the “Breached only” box only appears when there are deadlines at all.

A ticket has two clocks but the column has only one slot — it shows the most urgent OPEN deadline. If the first response was missed and the resolution is still running, the column shows the remaining time of the resolution with a red “!” next to it. That mark says: a deadline on this ticket has already been breached — and that is exactly how the “Breached only” filter finds it, because it asks for any breached deadline, including one that is long finished. Which of the two it hit is written in the ticket itself.

You can also sort by it: under the same “Deadline” heading sits a field with “Due soonest first” and “Due latest first”. Tickets without a running clock always end up last — they are not the least urgent, they are simply not affected. Sorting by deadline takes precedence over sorting by “Updated at”: no list can satisfy two orders at once.

The ticket list with the “Breached only” box ticked, the red-framed filter and the equally framed “Deadline” column.
With the “Breached only” box ticked, a single ticket is left. On ticket 4 the first response was missed. The column still shows a running remaining time, because it shows the next OPEN deadline, and here that is the resolution. The red “!” next to it names the breach.Open image at full size
A ticket with the red “Breached” badge on the first response and a running remaining time on the resolution, below it the deadline history.
The same ticket, two clocks, two states. The log holds the reason: “due date passed”, after 16 minutes of working time used.Open image at full size
6

On breach: notify, or hand the ticket over to another team

Professional only

Before you start: Handing over is deliberately not the default. It moves the responsibility, clears the assignee and resets the status — a ticket somebody is working on right now afterwards lies somewhere else. Choose it only when exactly that is intended.

Per target you set under “When breached” what happens on a breach: “Record only” just records it, “Notify assignee and observers” sends a mail to the assignee and the observers (not to the whole team), “Hand over to another team” hands the ticket over. For the handover you have to pick a target team — a policy without one is rejected on saving, because it would look configured and do nothing.

The action runs exactly once per clock. Without that latch a restart of the server would send the same mail again. The “already done” mark is set even when sending failed — a mail that did not arrive is better than a loop that sends a new one every minute.

The breach itself is dated to the moment it fell due, not to the check run — otherwise the reporting would hang on the rhythm of the checking service. And it is measured against the working time used: a paused clock cannot breach, even when the due date is long gone.

The handover resets the status to “Open”. The history rows about it are internal; the customer only sees the new status and the new team on the ticket.

An inactive example policy with the red-framed “When breached: Hand over to another team” choice and the “Network” target team.
The sentence below the target team says what happens: the ticket moves to that team, the current assignee is cleared. The “Active” switch is off here — an inactive policy does nothing.Open image at full size
7

SLA metrics in reporting

Professional only

Under “Reports” you choose the period and press “Generate report” — without that click the page stays empty. The report then holds the “Service level agreements” block with one row per target: met, breached, still running, achieved rate and the average time used.

Counting happens per target, not per ticket — it says so below the table as well. A ticket with both targets therefore appears twice, once in each row.

The achieved rate counts only decided clocks. Running ones do not belong in the denominator, otherwise every freshly switched-on SLA would look catastrophic at first and get better on its own. If there is not a single decided clock yet, a dash appears — not “0 %”.

If you work with group incidents, there is an additional “Achieved without group incidents” line: a single outage with a hundred attached tickets would otherwise distort the rate in both directions. It leaves out every ticket that is linked to an incident.

Agents only see their own teams in this block. Without Professional the block only appears if there is deadline data from before; it then stays readable.

The “Service level agreements” report block with the Met, Breached, Still running columns, the red-framed “Achieved” column and the average time used.
For the first response three deadlines are met and one is breached, ten are still running. That makes 75 %. The two columns to the right of it only appear when group incidents exist: they leave out every ticket that is linked to an incident.Open image at full size

Time tracking per ticket

Agents log the effort a case has cost. This means the work on the ticket, not the attendance of a person — it is explicitly not a clock-in system. This whole block is part of Professional.

1

Switch it on before anything is logged

Professional only

Time tracking is off as a factory setting. While it is off there is no field and no column. The “Time spent” card in the report then only appears if time was logged in the chosen period.

A dead field would be worse than none at all, so the feature disappears completely instead of sitting there greyed out.

The switch sits under “Settings → General” on the card “Time tracking per ticket” and is called “Enable time tracking”.

Every team then takes part. To leave one out you switch it off on the team itself, under “Settings → Teams” in the “Team details” box.

A company with an internal IT team and a customer-facing team often needs it only for the second one.

If you switch time tracking off again later, the entries that exist stay readable and exportable — they are a basis for invoicing, not a convenience. Nothing new can be logged. Existing entries can then no longer be changed or deleted either.

The “Time tracking per ticket” card under “Settings → General” with the main switch, the rounding, the quick buttons and the stopwatch.
Every setting for time tracking on one card. The red frame sits on the main switch, and below it stands what switching it off means.Open image at full size
The “Team details” box with the “Time tracking” switch and its explaining sentence.
On the team you leave a single team out. The red frame sits on the switch; entries that already exist stay visible even then.Open image at full size
2

Logging effort on a ticket

Professional only

The ticket carries a card called “Time spent”. “Log time” opens the input.

Quick buttons sit next to the field: one click on “30m” logs thirty minutes. Which buttons appear is set in the settings.

The “Duration” field also takes free input: “90” is ninety minutes, “1.5h” is an hour and a half, and so is “1h 30m”. A number without a unit is always minutes.

Input the system does not fully understand is rejected. “1h in the evening” does not become an entry of one hour — it becomes an error message.

In “What for (optional)” you write what the time was for. The text travels into the export and does not appear in the ticket history.

Several agents log time on the same ticket. Every entry carries its day, its note and the name of the person who did the work.

Time is logged onto a day, not onto a clock time. The input has a date field for this that starts with today; to fill in yesterday you pick the day before there. A day in the future is not accepted. A clock time would claim a precision the input does not have.

The open input of the “Time spent” card with the quick buttons, the duration field, the date, the “Billable” switch and the note field.
The red frame sits on the quick buttons. Next to them the field takes free input. Its placeholder shows the formats it accepts.Open image at full size
The list of time entries on a ticket with three entries from two agents, each with a date, a note and a name.
Three entries, two agents, one ticket. The red frame sits on one entry: duration, day and name on top, the note below.Open image at full size
3

The stopwatch

Professional only

For long sessions there is a stopwatch on the ticket: “Start timer” starts it, “Pause” holds it.

The stopwatch never creates an entry by itself. It proposes the elapsed time, and nothing is saved until you press the “Log …” button that names the time. What gets logged is the time that has actually run.

It replaces mental arithmetic, not knowledge. Without it the feature is complete, because typing the value is the actual path.

Opening another ticket pauses the running stopwatch, and the new ticket tells you which ticket it is attached to. If time that has not been logged is still waiting on another ticket and you start the stopwatch here, the application asks first. The “Start timer” question offers “Log …” for the time on the other ticket, “Discard” and “Cancel”. It appears from one minute of elapsed time.

A hidden window is not a break. The stopwatch keeps running if you merely click away.

Against a stopwatch left running overnight there is a maximum runtime. The value is capped, never discarded, and the agent is told.

The stopwatch is off as a factory setting. You find it in the settings under “Stopwatch on the ticket”.

The running stopwatch on the “Time spent” card with its reading, “Pause”, “Discard” and the button that logs it.
The stopwatch is running. The red frame sits on the button that takes the reading over; until then nothing is saved.Open image at full size
4

Billable or not

Professional only

Every entry carries a “Billable” switch. The time is logged once, and the switch decides whether it goes onto the invoice.

That is why the ticket can show two totals: everything logged on the left, the billable sum on the right. The second total only appears when it differs from the first.

There is no separate type for goodwill. Goodwill, warranty work and internal rework are called different things in every company, and the system knows only the one distinction that money hangs on.

This is how you log goodwill: enter the time as usual, switch “Billable” off and write the reason in the note.

The entry then visibly carries “not billable”. The minutes stay in the logged total, because the work did happen.

Anybody who does not log the time at all loses the very number that later explains why a customer was charged so little.

If most of your work is not billable, turn the default around with the switch “New entries are billable by default”.

The “Time spent” card with both totals in its header and one entry carrying the “not billable” mark.
Both totals stand side by side at the top. The red frame sits on the entry without a tick: its minutes count on the left and not on the right.Open image at full size
5

To the minute or rounded up

Professional only

As a factory setting everything is billed to the minute. Anybody who bills in quarter hours sets two values.

“Rounding increment (minutes)” is the step. Every entry is rounded up to the next multiple.

“Minimum per entry (minutes)” is the floor. Every entry is billed with at least this value.

The two work one after the other: first the floor, then the step. With a floor of 20 and a step of 15, five minutes become thirty, because the result has to satisfy both.

Below the two fields stands a sample sentence with your own values. It is calculated, not claimed.

Only the billed value is ever rounded, and only per entry — never the total. Two small entries are therefore rounded up twice.

The logged time stays untouched. Changing the rounding later falsifies no old data, because the value is worked out when it is shown.

You see both on the entry: where rounding changes the value, the result stands next to it in brackets.

The “Rounding increment” and “Minimum per entry” fields with the calculated sample sentence and the note below.
The red frame sits on the sample sentence, calculated from the values above it. The sentence below says what the rounding does not touch.Open image at full size
A time entry of five minutes with the billed value next to it in brackets.
The red frame sits on the entry the rounding changes. On the left stands what was logged, in brackets what is billed.Open image at full size
6

A time entry before closing

Professional only

A service provider often wants no ticket closed without logged time. There is a switch for that.

It is called “Require a time entry before resolving or closing” and is off as a factory setting.

It applies only when a person changes the status, and only to people who may log time. It also applies when a reply template sets the status on a single ticket. An agent without an entry gets a message and the ticket stays open.

Auto-close, merging and bulk actions are never blocked. Otherwise there would be tickets nobody can close any more.

This is the most dangerous switch of the whole feature. Only turn it on once your team really logs time every time.

The “Require a time entry before resolving or closing” switch with the sentence that names the exceptions.
The red frame sits on the switch. The sentence below names the three cases that are never blocked.Open image at full size
7

The “Time” column in the ticket list

Professional only

The ticket list gets a “Time” column showing how much has already been logged on a case.

You do not switch it on. It appears as soon as time tracking is on. Only agents and administrators see it. You can remove it from your list with “Columns”.

On narrow windows it is one of the first to drop out again. The list then keeps the columns without which a ticket cannot be found.

The ticket list with a “Time” column and values on the tickets that carry logged time.
The red frame sits on the column. Only the tickets with logged time carry a value.Open image at full size
8

The report

Professional only

Time that only stands on a single ticket is no basis for an invoice. That is why the report page carries a “Time spent” card. Only people with the “Time tracking: see the report” permission see the card.

Four numbers stand at the top: logged, billed, the number of entries and the number of tickets that carry any time at all.

That last number is the most important one after the total. Forty hours on three out of five hundred tickets is not an evaluation — it is three agents who are the only ones logging.

Below that come the breakdowns: by requester, by team, by category and by day.

On top of that comes one table per custom field. That is the road to billing by company or cost centre: you create a custom field, fill it in on the ticket, and the report groups by it.

The period at the top of the page applies to the day the work was done. July work on a June ticket therefore stands in the July report.

A note below the export buttons deserves to be taken seriously: the figures come from entries made by people and from your rounding rules. They are a working basis, not an audited invoice.

The report page with the “Time spent” card, its four numbers and the tables below.
The card sits on the report page. The red frame shows where to find it.Open image at full size
The four tiles of the card: logged, billed, entries and tickets with time.
The red frame sits on the number of tickets with time. It puts the total on its left into perspective.Open image at full size
The tables by requester, by custom field, by team and by category, each with logged and billed time.
The red frame sits on the breakdown by category. Every row names both totals.Open image at full size
The table for the “Cost centre” custom field with one row per cost centre.
One table per custom field. The red frame sits on the breakdown by cost centre.Open image at full size
9

The export for accounting and for the customer

Professional only

Three buttons sit below the card. They deliver the individual entries, not the totals from the page. They contain exactly the entries that match your filters.

These are two recipients, not three file formats. “Export entries (CSV)” and “Export entries (Excel)” go to accounting: both are complete and are never truncated.

“Export entries (PDF)” is the document for a human being. It goes to the customer as an attachment to the invoice. The PDF has no column for the note.

The PDF is capped at 20,000 entries, and the document says so itself. Nobody reads an invoice with more lines than that anyway.

All three files are built from the same source: filters, rounding, columns and figures exist once, so the three cannot drift apart.

An entry that is not billable has an empty cell in the billable column, not a zero. A zero would be summed up in a pivot table.

If “Per-agent evaluation” of time tracking is off, the “Agent” column is missing from all three files. If your licence falls back to Basic, the existing entries stay readable and exportable.

The three buttons “Export entries (CSV)”, “(Excel)” and “(PDF)” with the sentences that name the difference.
The red frame sits on the three buttons. The sentences below say which file is meant for whom.Open image at full size
A page of the generated PDF with the table of individual entries. The totals stand on page 1.
This is the document the customer receives. Every line is one entry with its date, ticket, agent, note and both values.Open image at full size
10

Customers do not see the logged time

Professional only

A customer never sees the time entries, not even on their own ticket.

This is not a setting but a lock in the server. There is no switch that opens it.

The reason sits in the entries themselves: notes are written for the team. They say what went wrong and how long the search for the cause took.

Other systems of this kind do the same. Where time reaches the customer, it reaches them as a document.

That is what the PDF export is for: it goes out with the invoice and not onto the ticket in the customer portal.

More on this in the card: The export for accounting and for the customer

The same ticket as the customer sees it: description, comments and status, but no “Time spent” card.
The same ticket, seen by the requester. The card with the time is missing entirely.Open image at full size
11

The per-agent breakdown can be switched off

Professional only

The report can additionally show who logged how much. As a factory setting it does not.

Time per person is performance data, and in many companies the works council has a say in it.

The switch is called “Per-agent evaluation” and sits in the settings.

While it is off the server does not even deliver the figures. The table is not hidden — it does not exist.

That difference matters. A lock that only the display knows about is not a lock.

More on this in the card: No availability history, no per-person evaluation

The report with the tables by team and by day, without a table per agent.
This is the report as a factory setting. Between category and day there is no table per agent.Open image at full size
The same place with the switch on: a “By agent” table with one row per agent.
The same place after the switch has been turned on. Between “By category” and “By day” there is now a table per agent.Open image at full size

Reporting and dashboards

The dashboard shows where a team stands. The report answers a question you ask yourself. Both only read; neither ever changes a ticket. Apart from your own fields, this whole block is part of Basic.

1

The dashboard: where things stand

At the top there is one tile per status with its count. Below them stand three figures for the whole team: “Total tickets”, “Tickets which are not Closed” and “Avg. resolution time”.

The middle figure is the important one. It says how much work is currently open. Resolved tickets count towards it until they are closed.

“Avg. resolution time” stays empty while no ticket has been resolved. A dash is more honest than a zero.

The card “Top 3 longest open tickets” names the three oldest open cases with their age. These are the ones nobody brings up any more. The card “Top agents closed tickets” counts the tickets each agent closed. A selection on the card sets how many days it looks back.

Below that sit three charts: “Tickets by status”, “Tickets by priority” and “Tickets by category”.

The dashboard shows the current state. You cannot pick a period for the whole dashboard here; that is what the report is for.

The Helpdesk team dashboard with the status tiles on top and the three key figures below.
The red frame sits on the total. In this example world the team has 22 tickets, 18 of them not closed.Open image at full size
The “Top 3 longest open tickets” card with three cases and their age.
One click on an entry opens the ticket.Open image at full size
The charts “Tickets by status”, “Tickets by priority” and “Tickets by category”.
The categories are the team’s own. A different team shows different ones here.Open image at full size
2

Every team has a dashboard of its own

The sidebar carries one entry per team. It is called “Dashboard” followed by the team name.

Each entry shows only its own team’s tickets. The figures, the categories and the oldest cases are therefore different per team.

There is no permission per dashboard. Agents see the dashboards of every team they belong to, administrators see all of them. Customers only see a team’s dashboard if the team’s switch “Can see their own tickets of this team in the dashboard and in reports” is on.

Anyone without the right to a dashboard does not see the entry at all. A blocked entry that is still visible only raises questions.

The Helpdesk team dashboard, with the sidebar entry “Dashboard · Helpdesk” highlighted.
The red frame sits on the sidebar entry. In this example world Helpdesk shows 22 tickets.Open image at full size
The same dashboard for the Network team with different figures and different categories.
The same page, a different team. Here it is 6 tickets, and the categories are “Wi-Fi” and “Firewall”.Open image at full size
3

Generating and filtering the report

The “Reports” page is empty when you open it. Only the filter box is there.

Only the click on “Generate report” starts the calculation. It takes a moment, because every section is computed at once.

That is deliberate. A report that recalculates on every keystroke would be unusable on a large data set.

Afterwards four key figures stand at the top and the charts below them.

Every chart names its figures. The rings print count and share in the legend beside them; the bars print the count above the bar.

The filter box above is where you ask the question. You can choose the period through “From” and “To”, the team, the status, the agent, the requester, the site, the priority, main and sub category, and the channel the ticket arrived through.

If you set several fields they apply at the same time. “Period July, team Helpdesk, priority High” is a single question.

The period goes by the day the ticket was created.

There is one exception. The time report goes by the day the work was done. July work on a June ticket therefore appears in the July report.

After every change to the filter you have to click “Generate report” again.

This page also carries the analyses of other features. They only appear when the feature is switched on and something happened in the chosen period.

They are explained where they belong: deadlines under “SLA figures in reporting”, ratings under “The evaluation of the ratings”, distribution under “What the distribution did” and effort under “The time report”.

The report page right after opening: only the filter box, no figures.
The red frame sits on “Generate report”. Until someone clicks it, the page stays empty.Open image at full size
The report page filter box with period, team, status, agent, categories and channel.
All fields apply at the same time. Empty means “all”.Open image at full size
The generated report with four key figures and the first charts below.
In this example world there are 28 tickets. Every bar carries its count above it, and the rings show count and share beside them.Open image at full size
4

Filtering and grouping by your own fields

Professional only

If you have created your own fields, the report offers them just like the built-in ones. That holds for every field type, including “Integer”, “Decimal”, “Date” and “Yes / No”.

Every one of your fields gets a filter in the box and a chart of its own in the report.

That answers questions only your company asks. “How many tickets go to which cost centre?” is one of them.

The chart names are the names of your fields. They are not translated, because they come from your installation.

Where you create your own fields is described under “Custom fields”.

Two charts built from custom fields: “Asset tag” and “Cost centre”.
This example world has the fields “Asset tag” and “Cost centre”. Your installation shows your own here.Open image at full size
5

Which columns the report shows

Under “Settings → Report Settings” you decide which fields the report offers.

The page has three sections: “Admin”, “Agent” and “Customer”. Each section carries the same list with its own switches.

A field you switch off here disappears for that role from the filter and from the export. That includes the CSV and Excel files.

As a factory setting administrators and agents see everything. Customers see less, because they do not need the agent, the site or the priority.

Your own fields appear under “Custom fields” in the same list.

The “Report Settings” page with the three sections “Admin”, “Agent” and “Customer”.
The red frame sits on the “Customer” section. Every role has a list of its own.Open image at full size
6

Customers pull a report of their own

A customer can open the same report as an agent. In it they see only their own tickets.

The limit sits in the system, not in the filter. A customer cannot get around it even by typing the address by hand.

You unlock it on the team. The switch sits under “Settings → Teams” and is called “Can see their own tickets of this team in the dashboard and in reports”.

As a factory setting it is off. While it is off a customer finds neither the dashboard nor the reports.

Which columns the customer sees comes from the “Customer” section of the report settings.

The file output is open to them as well. A customer can download their own tickets as CSV, Excel or PDF.

The team switch that opens dashboard and reports to a customer.
The switch sits in the “Customer permissions” box. It applies to this one team.Open image at full size
The report page from a customer account, with fewer filters and smaller figures.
The same page from Julia Becker’s account. In this example world she sees 8 tickets instead of 28, and the agent filter is missing.Open image at full size
7

Exporting as CSV, Excel or PDF

Below the filter box stand three buttons: “CSV export”, “Excel export” and “PDF export”.

All three use the filters as they stand at the moment you click.

The Excel file has the “Key figures” sheet with the figures. The “Tickets” sheet with the individual cases is only added when you tick “Include ticket table in export”.

Figures and charts are always included. The list of individual tickets only when you tick “Include ticket table in export”.

When you tick it, the real ticket count and the estimated page count appear below.

With a great many tickets a red warning appears as well. It says the export can take a while.

CSV and Excel contain every row. The PDF stops at 20,000 tickets and writes that into the document.

The limit already appears on the page before you export. A limit you only learn about in the finished document comes too late.

The three export buttons and below them the ticket table tick box.
The red frame sits on the tick box. Only when it is set does the line with the ticket count appear. In this example world that is 28 tickets and about 4 pages.Open image at full size
8

The PDF prints the figures next to the charts

The PDF is meant to be handed on. It contains the same charts that stand on screen.

Below every chart stand the figure it was built from and the share as a percentage.

That is why they are there. A bar can be looked at, but not checked.

On screen the mouse pointer shows the same figure. On a printed sheet there is no mouse pointer.

The document names the period and the day it was created at the top. Without a date in the filter there is no period to name.

A page of the generated PDF with charts and their figures below them.
The document as the recipient gets it. Below every chart stand the count and the share.Open image at full size

Satisfaction surveys (CSAT)

Once a ticket is closed you ask your customers how it went. This whole block is part of Professional.

1

The survey after closing

Professional only

Before you start: Two things have to be in place, otherwise nothing happens. Sending e-mail has to be set up. And under “Settings → Security” the public address of this installation has to be correct, because the link in the mail is built from it. With the wrong address stored there the system still sends the survey, and your customer ends up on a page that does not exist.

When a ticket is closed, the requester receives an e-mail with five numbered lines, one per rating from one to five stars. Each line is a link of its own, and one click is the whole answer.

The mail does not go out immediately. The system waits an hour after closing, and from then on a background service sends the surveys that are due every ten minutes. The hour is deliberate: a ticket that is reopened straight away should not trigger a survey.

There is exactly one survey per ticket. Even if a ticket is reopened and closed again later, the system does not ask a second time.

The link needs no customer account and is valid for 30 days. Until then your customer can change the rating — a misclick on the wrong star is more common than abuse.

A comment is optional. Clicking a star is already a rating; anyone who wants to add something finds a field for it on the page and confirms with “Update rating”.

The page shows only the number and the title of the ticket. Description, comments and history are not on it: the link is a right to rate, not a right to read — it can be forwarded, or land in a shared mailbox.

The click from the mail only writes the rating once the page has loaded. That is why virus scanners and preview fetchers do not rate your tickets: they fetch the address, but they run no JavaScript. For a human being it still is one click.

The rating that comes back sits on the ticket, where agents and administrators of the responsible team can see it. The customer never sees it there, not even their own.

Not every closed ticket is asked. Without an address for the requester no mail goes out at all. Nor does a survey go out if the requester closed the ticket themselves or if their address is on the blocklist. Merged duplicate reports as well as the reports attached to a major incident stay out of it too — resolving an incident closes every attached report with a single click, and without that exception each reporter would be surveyed about the same piece of work. External people also only receive the survey after giving consent. The card “Who receives the survey” explains who counts as external.

Every survey e-mail ends with a link to unsubscribe. After a rating, the survey page also shows the link “Stop receiving surveys”. The card “Consent and unsubscribe” explains both.

More on this in the card: Who receives the survey, Consent and unsubscribe

The survey mail in the customer’s mailbox with five numbered rating links and the link to the survey page.
This is how the survey arrives. Each of the five lines is a link of its own, below them sits the way to the page with the comment field. The address in the links is the one you stored under “Security”.Open image at full size
The survey page with five stars, the rating set, the comment and the thank-you message.
The page after the click on the fifth star: the rating is saved, the comment field stays open. Only the number and the title of the ticket are shown.Open image at full size
The rating on the ticket with five stars and the customer’s comment.
The same result on the ticket. The red frame sits on the rating — it is here for the team, not for the customer.Open image at full size
2

Switching it on and limiting it

Professional only

The survey has exactly one place to set it up: under “Settings → General”, in the card “Customer Satisfaction Score (CSAT)”. This card explains the three controls for sending. The field “Own e-mail domains” on the same card is explained in the card “Who receives the survey”.

“Send satisfaction surveys” switches sending on; it is off as a factory setting. Only tickets closed after you switch it on are surveyed — otherwise your entire backlog would receive a mail in one go.

If you switch it off again, the ratings you already have stay visible. Only nothing new goes out any more.

Above the switches you see the address the links are built from. It is there to be checked, not to be edited: you change it in the one place where it is maintained, and the hint next to it takes you there.

The middle switch, “Per-agent evaluation”, belongs to the report. What it does there, and why it is off as a factory setting, is on the card about the report. It stays usable even while the survey is switched off.

“At most one survey per requester within” limits how often the same person is asked. The factory setting is 7 days: someone who reports several tickets within that window is still asked only once.

With 0 you ask on every closed ticket. For an internal helpdesk that is usually too much, because the same people report again and again; a customer desk with many different senders rarely reaches the limit at all.

The survey is deliberately plain. The scale is fixed at one to five stars, and so are the one-hour delay and the 30-day validity. Two different scales in the same database would mean the report averages things that cannot be compared.

More on this in the card: The report on the ratings, Who receives the survey

The “Customer Satisfaction Score (CSAT)” card with two switches and the number field for the limit.
The whole setting on one card. The red frames sit on the two switches and on the field for the limit; above them stands the address the links are built from.Open image at full size
The “Public address of this installation” card with the address field and the “Currently in use” line.
The address itself is maintained under “Settings → Security”. The line below tells you which address is in use right now and where it came from.Open image at full size
3

Who receives the survey

Professional only

Before you start: After the update to 1.11.0, external people only receive the survey after giving consent. So enter the e-mail domains of your company. Otherwise your employees count as external as well and no longer receive a survey.

The survey distinguishes two groups of recipients. Employees of your company receive it without being asked first. Everyone else counts as external. External people only receive the survey after they have given consent.

Employees can unsubscribe at any time. External people can withdraw their consent at any time. The card “Consent and unsubscribe” explains how.

You decide who counts as an employee in the field “Own e-mail domains”. It is under “Settings → General” in the card “Customer Satisfaction Score (CSAT)”. Only administrators can see and change the field. Enter the domains of your company there, separated by commas. Then click “Save domains”.

An address counts as an employee if its domain is in the list. An entry also covers its subdomains. So “example.com” also applies to “it.example.com”, but not to “myexample.com”.

When saving, the system tidies up the list. Capital letters become small letters, an “@” at the start is dropped, and duplicate entries disappear. If an entry is not a valid domain, the message “These entries are not valid domains:” appears with this entry. Nothing is saved in that case.

If the field is empty, every address counts as external. That is the factory setting.

For a single account you can override the domain. Open the account under “User management” with “Edit”. In the field “Satisfaction survey” you choose “Automatic by domain”, “Employee” or “External”. The factory setting is “Automatic by domain”. Next to it, “Result: …” shows what the domain list means for this account.

The choice on the account applies to the e-mail address of that account. It helps, for example, with an employee whose address has a different domain.

After the update to 1.11.0, the field contains the allowed domains of your single sign-on providers. If you do not use single sign-on, the field is empty.

As long as the survey is switched on and nobody has saved the field, the card shows a box: “Since version 1.11.0, external people receive the survey only after giving consent. Enter your company's e-mail domains so that your employees keep receiving the survey.” Only administrators see the box.

Administrators also see the same sentence as a banner at the top of every page. As long as the box is shown, the banner appears as soon as at least one survey was not sent in the last 30 days. “Open the survey settings” leads to the card. “Hide for 30 days” hides it for your account for 30 days.

There is one thing to do: enter the domains and click “Save domains”. This also applies if the list is already correct or is meant to stay empty. After that, the box and the banner disappear.

Below the field, a line counts the surveys that were not sent in the last 30 days, for example “Surveys not sent in the last 30 days: 2 without consent, 1 after unsubscribing.” Each ticket counts once. Other reasons, such as the blocklist, are not counted. The link “Show consents and unsubscribes” next to it opens the list from the card “Consent and unsubscribe”. Only administrators see the line and the link.

The rule only applies to the satisfaction survey. All other e-mails go out as before, for example the replies of agents.

More on this in the card: Consent and unsubscribe

The “Customer Satisfaction Score (CSAT)” card with the box about the update, the field “Own e-mail domains”, “Save domains” and the line with the count.
The red frames sit on the field “Own e-mail domains” and on “Save domains”. At the top stands the box that stays until the field is saved for the first time.Open image at full size
The “Edit user” dialog with the field “Satisfaction survey” and the line “Result: …” next to it.
The red frame sits on the field “Satisfaction survey”. Next to it you see what the domain list means for this account.Open image at full size
5

The report on the ratings

Professional only

Under “Reports” satisfaction has a section of its own, “Customer satisfaction (CSAT)”. It appears in the same report as everything else, but it only follows two of the filters: the period and the team. Without a date it covers the last 30 days.

Five tiles sit at the top. “Average score” is the average of the stars, “Satisfaction rate (4-5 stars)” tells you what share was satisfied, “Response rate” is how many answered, and “Surveys sent” counts the surveys that went out. Below both rates you find, in small print, the fraction they were built from.

“Closed without survey” is the fifth tile. It counts the closed tickets that were never asked, with the total number of closed tickets underneath. Without that number you would take a rate as the picture of your customers, and it would rest on a subset you cannot see.

The number that matters most is not the average, it is the response rate. A good score built on few answers says little about your customers.

Below that comes the distribution: for every star count from five down to one a bar shows how often it was given, with the number next to it. Then comes “Trend”, one row for each day somebody answered, with the date, that day’s average as a bar and the number of answers. Last come “By agent” with one row per agent and “Latest comments” with what people actually wrote. A “By team” breakdown joins them as soon as more than one team has rated tickets.

You can switch the per-agent breakdown off. “Per-agent evaluation” is off as a factory setting, because ratings per person are performance data — in many companies the works council has a say in that, and with cloud providers this evaluation often cannot be switched off at all.

The switch takes effect on the server and not only on screen: with it off, the server does not deliver the breakdown at all.

The single rating on a ticket is untouched by this and stays visible to the team. The switch governs evaluation across people, not what is shown on one case. There is no export of the CSAT section of its own. Agents only see teams here whose “Agent Permissions” allow seeing reports.

The “Satisfaction” filter narrows the report down to ratings. “Rated only” shows rated tickets, “Not rated” shows the unrated ones, and with “Score from” and “Score to” you can look at every ticket with one or two stars. The filter applies to the table and to both exports.

The “Customer satisfaction (CSAT)” section of the report with five key figures and the distribution of the stars.
The five tiles of the section. The red frame sits on “Closed without survey” — the number that puts the response rate in perspective.Open image at full size
The “Trend” section with one row per day, the average as a bar and the number of answers.
The course over time. For each day you see the date, the average as a bar with the figure next to it, and on the right how many answers came in that day. In the example both answers arrived on the same day, so there is one row.Open image at full size
The “By agent” breakdown with one row per agent, and the latest comments.
The breakdown per agent, together with the comments as they were written. This part of the report is the one you can switch off.Open image at full size
6

A poor rating as a trigger

Professional only

A rating can trigger a rule. In the rule editor under “Settings → Automation” there is a condition for it, “Satisfaction rating (CSAT)”, and next to it you pick “is at most”, “is at least”, “is” or “is not”. The third field holds the stars, from one to five, with the number beside them.

The usual case is “is at most 2”. Above the rule you then read the sentence the editor writes along: “When a ticket was rated 2 stars or fewer, then send an e-mail to the assignee.”

This rule needs no time condition. A new rule comes with the condition “Time without any activity” “longer than” 3 “days” in the “WHEN” block; remove it so that the block is empty. That makes it the exception among the rules: all the others wait for nothing to have happened for a while, this one waits for an event.

As an action you have everything a rule can do anyway: send a mail, raise the priority, hand the ticket to another team, or set a follow-up.

One thing works differently here. Rules normally leave closed tickets alone, but a rating almost always arrives on a closed ticket — so a rule with this condition reaches closed tickets as well. Every other rule still does not.

The condition never applies to a ticket without a rating, and that includes “is not” — otherwise “not five stars” would hit your entire unrated backlog. If you want to know how many did not answer, that is the response rate in the report.

The rule acts once per rating. Below it, “Log” opens the table “What this rule did” with one row per ticket, so you can see when it ran and what it did.

The rule editor with the condition “Satisfaction rating (CSAT) is at most 2” and the sentence above it.
The condition in the editor. The red frames sit on the condition and on the sentence above it, and that sentence rewrites itself with every change.Open image at full size
The “What this rule did” table with one row for the poorly rated ticket.
The rule’s log. The row shows the ticket, the time and the action that was carried out.Open image at full size

Knowledge base

The part that prevents tickets: solutions written down once, found again by your team — and suggested to the requester while they are still typing. Everything in this block is part of Basic, except the e-mail about entries waiting for approval.

1

Topic tiles with articles and attachments

You reach the knowledge base through “Knowledge Base” in the left-hand bar. The overview consists of tiles — one per topic. The number in the top right of a tile is the count of published entries; below it stand the name and description of the topic. A click on the tile leads to the list of entries, each with author, change date and the first lines of its text.

You do not create the topics here but under “Settings → Knowledge Base” (see the card “Visibility per topic”). Without a single topic the overview shows nothing but a note — an entry always needs a topic.

You write with “New entry” on a topic page. The editor asks for three things: “Title”, “Topic” and “Content”. It is the same editor as in a ticket, with the same toolbar: “Bold”, “Italic”, “Underline”, “Strikethrough”, “Text color”, “Highlight color”, “Bullet list”, “Numbered list”, “Quote”, “Link” and “Clear formatting”. A link is made as in a ticket: select the text, click “Link”, enter the address — web and mail addresses are allowed (http, https, mailto). “Save” stays grey while title or topic are missing, and an entry without text is rejected: attachments alone are not an entry.

Images get into the text through the clipboard, just as in a ticket: take a screenshot, paste it into the editor with Ctrl+V. A marker such as “[inline-image:1]” appears in the text; on saving, the system uploads the image and shows it in exactly that place. It additionally turns up below under “Attachments” — that is where you delete it again. PNG, JPEG and GIF can be pasted.

You attach files only once the entry is saved: at the bottom of the entry page sits the “Attachments” card with “Upload file”. Allowed file types and size are the same as for a ticket (up to 50 MB per file). Whoever uploaded a file may remove it again; administrators may remove any of them.

Administrators may always write, agents as long as the switch in the settings allows it (see the card “Approval”). Customers only read. An administrator may delete any entry; an agent may only delete their own entries that have never been published.

The knowledge base overview page with three topic tiles and the “Knowledge Base” menu entry framed in red.
The way in: “Knowledge Base” in the left-hand bar. Every tile is a topic; the number names the published entries, the amber badge the waiting ones.Open image at full size
The “New entry” editor with the Title and Topic fields, the editor toolbar and the greyed-out “Save” button.
Title, topic, content. As long as no topic is chosen, “Save” stays grey — in the red frame the choice that is still missing here.Open image at full size
A knowledge base entry with formatted text, a pasted image of the printer display, a numbered list and the “Attachments” card holding two files.
A finished entry: header with topic, author and approval, below it the text with a pasted image. At the bottom stand both files — the quick guide to download and the pasted image.Open image at full size
3

Visibility per topic: internal only or customer-facing

Before you start: Visibility hangs on the TOPIC, not on the single entry. An internal note in a customer-facing topic is readable by customers as soon as it is published — plan your topics accordingly, and move an entry to another topic through “Edit” if you have to.

You maintain topics under “Settings → Knowledge Base” in the “Topics” card. Every row carries a name, a description, a sort number for the order of the tiles, the “Visible to customers” switch and two buttons for saving and deleting — you save per row, not the whole card.

With the switch off, only agents and administrators see the topic, its entries and their attachments — a customer never even gets the tile and does not find the entries through the search either. With it on, customers see the topic and the published entries inside it; drafts stay invisible anyway.

You create a new topic in the dashed row below: enter a name, choose the visibility, “Add topic”. A topic can only be deleted while it is empty — otherwise you would be deleting its entries along with it, without seeing them.

The “Topics” card with three topics; the “Visible to customers” switch is on for the first topic and off for “Internal runbooks”.
The difference sits in the two red frames: “Printing” is released for customers, “Internal runbooks” is not. You save per row with the blue button on the right.Open image at full size
4

Suggested solutions while a ticket is being created

As soon as three characters stand in the “Title” field of the “Create new ticket” form, the system searches in the background and shows the box “Possible solutions from the knowledge base” — up to five entries matching the title. Whoever finds their answer there does not create a ticket; that is the whole point.

Only the TITLE is searched, not the description. The same rule as in the search applies: a suggestion has to contain at least half of the words of the title — the more precise the title, the fewer and the more fitting the suggestions. A click on a suggestion opens it in a new tab so the half-filled form is not lost; “Open knowledge base” at the bottom leads to the full overview.

Visibility applies here too: a customer only gets published entries of customer-facing topics suggested. As an agent you additionally see internal topics and entries still waiting for their approval.

The “Title” field of the new-ticket form with the “Possible solutions from the knowledge base” box and the suggestions below it.
Only the title has been typed — the box below appears on its own. At the top stand the entries that match the title best.Open image at full size
5

Turning a solved ticket into an entry

Before you start: EVERYTHING is taken over: the description and every comment, the internal ones included. The text is a copy, not a link — read it through and remove names, phone numbers, e-mail addresses and order numbers before you save. Afterwards anyone who may see the topic can read it.

At the top right of every ticket sits “Add to knowledge base”. The button opens the editor for a new entry, prefilled with the title of the ticket and its whole course: the description as the first paragraph, every comment below it as a quote.

That alone gains you nothing — it is raw material. The point is that you turn it into a guide: cut it down to what will help next time, and rewrite the title if it sounds like a single case (“Printer on 2nd floor pulls two sheets” becomes “Clearing a paper jam”).

No topic is preselected, you choose that yourself. The entry is saved like any other: published straight away as an administrator, sent for approval as an agent. Afterwards the internal reference “Source: Ticket #1” stays on the entry — it is a jump back to the case and is not visible to customers.

A ticket with the “Add to knowledge base” button framed in red at the top right.
The button sits at the top right of every ticket — no matter which status the ticket is currently in. It is meant for the case that has been solved.Open image at full size
The “New entry” editor prefilled with the ticket’s title and course, above it the red-framed notice about the source ticket.
The notice in the red frame says what matters. In the text below stands the internal note with the purchase order number — exactly what has to go before saving.Open image at full size
6

Approval: entries by an agent wait for the administrator

Whether agents may write at all is decided by the “Agents can create entries” switch under “Settings → Knowledge Base”. It is on by default. Off, it is a hard boundary: the “New entry” button and the “Add to knowledge base” button on the ticket disappear, and calling the editor directly is refused as well.

There are exactly two states — “Awaiting review” and “Published”; there is no draft you can quietly work on without anybody seeing it. Who writes determines the state: an administrator publishes immediately. An agent produces an entry marked “Awaiting review” — visible to agents and administrators, not to customers. On the topic tile the amber badge “1 awaiting review” appears for it.

The administrators additionally receive an e-mail as soon as an entry is up for approval. That mail is part of Professional. It is an addition, not a requirement: without outgoing mail set up, the badge stays the way a pending approval is found. You approve on the entry’s page with “Approve & publish”; afterwards it says there who approved it.

If an agent later changes a published entry, it goes back for approval — the change is only visible to customers again after the next “Approve & publish”. Somebody who is already waiting and saves once more does not trigger a second e-mail. The same applies when an agent adds or removes an attachment.

The knowledge base settings page with the “Agents can create entries” switch framed in red.
The switch sits at the very top of “Settings → Knowledge Base”. The sentence beside it says what depends on it: entries by agents wait for approval.Open image at full size
An entry marked “Awaiting review” with the “Approve & publish” button framed in red.
The entry comes from the agent Marco Rossi and is waiting. One click on “Approve & publish” makes it visible to everyone who may see the topic.Open image at full size
7

Change history of the knowledge base

Under “Settings → Knowledge Base” the “History” card sits at the very bottom. It lists the last 200 events, newest first: what happened, which entry or topic was affected, who did it and when.

Seven events are recorded: entry created, updated, approved and deleted, plus topic created, updated and deleted. A deleted entry therefore does not vanish without a trace — the line stays, even when the entry is gone.

Two lines at once are not a mistake: when an administrator creates an entry, “Entry created” stands there and directly above it “Entry approved” — they publish without the detour through the approval. For an agent only “Entry created” appears at first; the approval comes later and with the administrator’s name.

Only somebody allowed to open the knowledge base settings page sees the history — administrators, by default. It is one history for the whole knowledge base, not one per entry.

The “History” card with lines such as “Entry created”, “Entry approved” and “Topic created”, each with a name and a time.
At the very top the agent’s entry that is still waiting for approval — it has no “Entry approved” line yet. Below it the administrator’s entries, each with both lines.Open image at full size

Backup & restore

Backups have an application of their own. It ships with the system and the installation sets it up, so there is nothing to buy and nothing to configure. This block shows what it saves, when it runs and how you get everything back when it matters. This whole block is part of Basic.

1

The application for backup and restore

The application is called “Ticket System Backup & Restore”. It sits next to the ticket system and has its own shortcut on the desktop.

There is a version for Windows and one for Linux. It is the same application, just built for each operating system.

It has six tabs. “Restore” lists the backups you have, “Create Backup” makes a new one, “Schedule” handles the timing, “Encryption” shows the recovery key, “Settings” shows the paths and “Log” the protocol.

The settings are filled in already. On its first start the application works out for itself where the ticket system lives.

The folder for the backups is under “Backup directory”. You can change it, for example to a different drive.

On Windows the application asks for administrator rights when it starts. Its settings apply to every administrator of the computer and live in “%ProgramData%\SMITEY\backup-app”.

The “Restore” tab with five backups, each with time, size, type and encryption.
The red frame sits on the “Encryption” column. New backups end in “.smbk” and are “Encrypted”. Older backups in ZIP format show “Not encrypted”. The “Type” column says whether a backup came from the schedule, was made by hand or was taken before an update.Open image at full size
The “Settings” tab with the backup folder and the database details.
The red frame sits on the name of the PostgreSQL container. Further down are the volumes that get saved along with it.Open image at full size
2

The schedule runs from the moment you install

Before you start: On Windows the application always starts with administrator rights and registers the schedule with those rights. If Windows does not let the task run without a signed-in user, it stays bound to a sign-in, and the application tells you so.

The installation sets up the daily backup by itself. It runs at 23:00 in the time zone of the ticket system.

The schedule lives in the operating system. On Windows that is Task Scheduler, on Linux the cron service. So there is no extra service running just for backups.

The backup does not need anyone signed in. On a server where nobody ever logs on it still runs.

The line below the buttons tells you whether the task really exists in the operating system. A ticked box only says what was saved.

Backups are kept in five tiers: 14 days, 4 weeks, 12 months, 4 quarters and 5 years. A backup stays as long as it is the newest of its period in one of those tiers.

What counts are calendar days, not files. Two backups on one day are one day.

Backups you create by hand are never deleted automatically. That is what the 0 at “Keep manual” means.

If you change the schedule, your change survives an update. The installation only sets it if you have never set a schedule. If you switched the backup off, it stays off. “Remove all scheduled tasks” lasts as well: an update does not set the schedule up again afterwards.

The “Schedule” tab with “Daily” ticked and the time set to 23:00.
The red frames sit on “Daily” and on the time. The sentence above names both ways: Task Scheduler and cron.Open image at full size
The line “Registered with the operating system: yes (Daily)” below the buttons.
This line is checked again on every start. If it says “NO”, nothing runs on its own — then use “Apply schedule” as an administrator.Open image at full size
The six retention fields: 14, 4, 12, 4, 5 and 0.
The red frame sits on the tiers. “Keep manual (0 = keep all)” means backups made by hand are kept.Open image at full size
The “Schedule” tab after “Apply schedule”, with “02:00 (America/New_York)” and “Registered with the operating system: yes (Daily)” below.
The red frames sit on “Apply schedule” and on the lines below it. The brackets show the time zone of the ticket system. The time applies in that zone and not in the time zone of the computer.Open image at full size
3

What a backup contains

A backup contains everything that makes up the state of your system. That is the database, the file attachments, the archive and the keys. Only a database outside SMITEY is missing from it.

The keys are the part that is easy to miss. They decrypt stored credentials, for example those of your mail account. Without them a restore would come back with dead credentials.

Each new backup is a single encrypted file ending in “.smbk”. It holds one file per volume, a list of its contents and the database as a text file if it is included.

The system keeps running while this happens. Your agents do not notice a backup at all.

“Estimate size” tells you up front how big the database is. The volumes with the attachments come on top. The backup is not compressed.

Nothing is ever overwritten. Every backup is a file of its own, and only the cleanup removes old ones.

Only administrators can read the backups. The same applies to the configuration file and the file with the first login in the installation folder. The installer and every update set these permissions themselves.

If your database runs on its own server and not in the SMITEY container, the application cannot back it up. Back it up with your own tools then. In that case the backup holds only the attachments, the archives and the keys, encrypted as usual. An update detects such a database by itself and switches the application over. Until then the daily backup fails on such an installation, unless you switch it over by hand first. On the command line you can also do this by hand with “config --database external”. With “config --database bundled” you switch back.

More on this in the card: Encryption and recovery key

The “Create Backup” tab with the buttons “Estimate size” and “Create backup now”.
The red frame sits on both buttons. The sentence above lists what is included.Open image at full size
The message at the bottom with the full path of the file that was created.
After it is made the file name appears at the bottom of the window. The time is part of the name.Open image at full size
4

Encryption and recovery key

Before you start: Keep the recovery key outside the server. Without it, no backup can be opened once the server is lost. Nobody can recover it for you.

Every new backup is encrypted. This applies to backups from the schedule, backups made by hand and backups before an update. You do not have to switch anything on.

Backups are encrypted with AES-256. The installation creates the key by itself. On an existing installation it is created with the first update to a version with encryption. It is stored protected on the server. Only administrators can read it.

This protects copies outside the server. Anyone who finds a backup on a network drive, a USB stick or in online storage cannot read it without the key. Anyone who controls the server itself also has the key.

The recovery key is the same key in a form you can write down. It starts with “SMBK-”. You find it on the “Encryption” tab and in the file “SMITEY-credentials.txt” in the installation folder. If you deleted that file, you still find the key on the “Encryption” tab.

“Copy” puts the key on the clipboard. “Save to file...” saves it with the key ID and the date in a text file. Keep it for example in a password manager or on paper in a safe.

Until you confirm that the key is stored, the application shows a yellow bar at the top. To confirm, click “I stored the key outside this server” and answer the question with “Yes”. The bar then disappears. The tab then shows when you confirmed.

The key ID tells you which server a backup belongs to. If a backup does not belong to this server, the application names its key ID. It then asks for the matching recovery key.

If the application cannot read the key, it makes no backup. It does not make an unencrypted one either. In that case the “Encryption” tab says that the key cannot be read. If the key file is missing altogether, the next backup creates a new key. The yellow bar then appears again, because the new key has to be stored as well. Older backups can still only be opened with the old recovery key.

Older backups in ZIP format are not encrypted. You can still restore them. The tab shows how many there are. The cleanup removes them by the same rules as any other backup.

On a server without a desktop, “key --show” shows the same on the command line.

More on this in the card: Getting everything back, On a server without a desktop

The “Encryption” tab with the recovery key, the key ID and three buttons. The yellow notice bar is at the top.
The red frames sit on the notice bar, on the key and key ID and on “I stored the key outside this server”. The key in the picture comes from a test environment.Open image at full size
The same tab after the confirmation, without the notice bar.
The upper frame sits on the time of the confirmation. The lower one shows how many backups are still not encrypted.Open image at full size
5

Getting everything back

Before you start: A restore overwrites today’s state. Everything created since the chosen backup is gone afterwards.

In the “Restore” tab you pick the backup you want back. Then you click “Restore”.

The application asks first. It says what will happen: today’s state is overwritten, and the application restarts the containers. If people are anonymized in today’s state, a second question follows. It names how many and asks whether to anonymize them again after the restore. “Yes” is preselected. With “No” the backup is restored without this step. If you close the window instead, nothing is restored.

The tick “Wipe target volumes before restore” empties the volumes first. That way no file is left behind that did not exist when the backup was made.

The steps appear in the “Log” tab. There you see one by one what the application did. If you answered “Yes” to the second question, a line at the end says how many anonymizations the ticket system applies again in the nightly run. If they cannot be carried over, the log shows a warning instead. If there were warnings, the status line at the bottom of the window says how many.

If the backup contains the database, the complete state comes back. Tickets, comments, history, file attachments, logged time and the knowledge base are all there again as they were at the time of the backup.

After that the system is usable again. On a small installation this takes less than a minute.

If the backup contains the database, it comes back completely or not at all. The volumes follow after it. If a volume fails, the database is already back but files can be missing; the “Log” tab shows which step failed. In every case the application starts the containers again afterwards, even if the restore failed.

A backup from an older version can be restored into a newer one. On its next start the system brings the database up to its own version.

Consents and unsubscribes for the satisfaction survey are carried over without a question. This also applies if you answer the second question with “No”. The application reads them from the running installation before the restore. Afterwards a line in the “Log” tab gives the number, for example “12 consent and unsubscribe record(s) were carried over.” The ticket system takes them over at its first start. A consent or unsubscribe made after the backup therefore stays valid. If the transfer fails, the log shows a warning. The restore still counts as successful.

The application first checks an encrypted backup completely. Meanwhile the status line says “Checking the encrypted backup before anything is changed...”. Only then does it stop the containers. If the file is damaged or was altered, it stops and reports “The backup file is damaged. Nothing was changed.”

If the backup comes from another server, the application asks for that server’s recovery key. This happens after the questions. The window “Recovery key needed” names the key ID of the backup. The same window appears if the key of this server is missing.

A typing error is noticed before anything is changed. The status line then reports “The recovery key has a typing error. Check each character.” After that the window asks again. If the key belongs to another backup, the status line reports “This recovery key does not belong to this backup.” With “Cancel” the application stops and reports “Restore cancelled. Nothing was changed.”

The application does not adopt the key you entered. It keeps its own. New backups are still made with the key of this server. If you restore on a new server, store that server’s recovery key as well.

A backup without a database restores only the attachments, the archives and the keys. Existing keys are kept. The database stays as it is. The application says so before the restore and asks. With “No” nothing is changed.

If the installation is set to its own database, the application skips the database part even when the backup contains a database. This applies to an older backup, for example. The application asks first. With “No” nothing is changed.

A selected backup in the list, with the tick and the “Restore” button below.
The red frames sit on the tick and on “Restore”. Without a selected row the button stays off.Open image at full size
The confirmation before the restore with the buttons “Yes” and “No”.
The question names both consequences: today’s state is overwritten, and the containers are restarted.Open image at full size
The protocol after the restore, with the message “Restore complete.” at the bottom.
Every step is there with its time. At the end the application reports “Restore complete.”Open image at full size
The second question “6 person(s) were anonymized in the current system.” with the buttons “Yes” and “No”.
The red frames sit on the question and on “Yes”. “Yes” is preselected. The number counts the people who are anonymized in today’s state.Open image at full size
The status line after the restore: “1 warning(s) while carrying over anonymizations and survey consents. See the Log tab.”
The red frame sits on the status line. It only gives the number of warnings. What exactly happened is in the “Log” tab.Open image at full size
The request for the recovery key with the key ID of the backup, an input field and the buttons “OK” and “Cancel”.
The red frames sit on the question with the key ID and on the input field. Hyphens, spaces and upper or lower case do not matter when you type the key. The key in the picture comes from a test environment.Open image at full size
6

On a server without a desktop

A server often has no desktop. So the same application also works as a command.

Five commands are what you need day to day: “backup” saves, “list” shows the backups you have, “restore” brings one back, “schedule” sets the timing and “config” shows the settings. For the key, “key” and “decrypt” come on top.

Behind them is the same application as in the window. There is no second path that does something different.

The application sits in “/opt/smitey/Backup”. You call it with “sudo” and add the command. The containers run as “root”, so the backup needs those rights too.

You can copy the six boxes below. They cover what is really needed in day-to-day use.

A restore asks here as well. It only runs when you add “--yes”. It then also carries over the anonymizations of today’s state, like “Yes” in the window. With “--no-reapply” it runs without this step.

There is a file on the server to read up on all this. It is called “BACKUP-RESTORE.txt” and sits in “/opt/smitey”. It goes through the schedule, every command and the way back once more, at your own pace. It exists in German and in English: if you chose German during the installation, you get the German one, otherwise the English one. Both versions also sit under “/opt/smitey/docs”.

“key --show” shows the recovery key, the key ID and the number of unencrypted backups. Once the key is stored outside the server, you confirm that with “key --confirm-stored”.

You restore a backup from another server with “--key-file”. The file you name contains the recovery key. The file from “Save to file...” works for this as well. Instead of the file you can also use the environment variable “SMITEY_BACKUP_KEY”. With “sudo” you put it directly before the program, that is “sudo SMITEY_BACKUP_KEY=<key> /opt/smitey/Backup/TicketSystemBackup restore …”. The key then ends up in the shell history. If the key does not match, nothing is changed.

“decrypt” writes the content of a backup as unencrypted files into an empty folder. These files are not encrypted. They contain passwords and personal data. Delete them as soon as you are done.

Show the backups you have

sudo /opt/smitey/Backup/TicketSystemBackup list

Each line carries the time, the reason, the size and the file name. It is the same list as in the window.

Show the schedule

sudo /opt/smitey/Backup/TicketSystemBackup schedule --show

The first line names the time that is set, with its time zone. The last one says whether the task really exists in the operating system. If it says “NO”, nothing runs on its own.

Change the schedule

sudo /opt/smitey/Backup/TicketSystemBackup schedule --daily 23:00 --keep 14

The time applies in the time zone of the ticket system. “--keep” says how many daily backups are kept. “schedule --off” switches the daily backup off.

Create a backup right now

sudo /opt/smitey/Backup/TicketSystemBackup backup

This backup counts as “Manual”. Backups made by hand are never deleted automatically.

Show the recovery key

sudo /opt/smitey/Backup/TicketSystemBackup key --show

The last line says whether you have already confirmed that the key is stored. The command does not create a key.

Restore a backup from another server

sudo /opt/smitey/Backup/TicketSystemBackup restore <file>.smbk --yes --key-file /root/recovery-key.txt

Replace <file> with the name or the path of the backup. You create the file “/root/recovery-key.txt” beforehand. It contains the recovery key. The file from “Save to file...” works too.

A command line on a Linux server with the list from “list” and the output of “key --show” below it.
At the top “list” shows the backups. Older backups in ZIP format carry the note “(Not encrypted)”. Below it “key --show” gives the recovery key, the key ID and the number of unencrypted backups. The key in the picture comes from a test environment.Open image at full size
7

The backups sit on the same machine

Before you start: A backup next to the system does not protect you from a disk failure. Copy the files to another place regularly.

The backups are files in the folder you set. That folder is on the same machine as the ticket system.

For the common cases that works well. Data deleted by mistake, an update that went wrong or an error in the data are all covered.

It does not help against the disk failing. If the disk is gone, the backups are gone with it.

So copy the files somewhere else. A network drive, a second server or storage in the network are enough.

A copied file can be loaded back on any server. On a different server you need the recovery key for that. With “Import backup file…” you bring the file back into the list.

The copies are encrypted. Nobody can read them without the recovery key. So do not keep the key next to the copies. Older backups ending in “.zip” are not encrypted.

The “Settings” tab with the “Backup directory” field.
The “Backup directory” field says where the files are. That is the folder you should copy elsewhere on a regular basis.Open image at full size
8

Before every update the system saves by itself

An update takes a backup of its own beforehand. That happens independently of your schedule and without you ticking anything.

It saves the same as always: the database, the attachments, the archives and the keys. If the database runs outside SMITEY, the update backs up only attachments, archives and keys.

This backup is made by the application “Ticket System Backup & Restore”. It is encrypted like any other and sits in the same folder. In the list its type is “Update”. The three newest of these backups are kept. The application deletes older ones by itself.

The notice before the update tells you so. You do not have to remember to save first yourself.

If this backup fails, the update stops before anything is replaced. A database outside SMITEY does not hold the update up. The update then switches the application so that the daily backup leaves the database out as well. Back up this database with your own tools.

More on this in the card: An update at the press of a button

The confirmation before the update with the note about the backup.
The sentence “A full backup is taken automatically beforehand” is part of the question. The backup runs before anything is replaced.Open image at full size

Important commands (Linux)

Ready to copy. Everything with sudo – installer and containers need root.

Install the prerequisite

sudo apt install -y unzip

Without unzip the installer cannot unpack the package.

Install the ticket system

curl -fsSL https://files.smitey.eu/download/get-smitey.sh | sudo bash

Downloads the package and walks you through the questions. Running it again is safe: configuration and data are kept.

Check HTTPS

sudo /opt/smitey/smitey-install check-https

For every HTTPS option. With a public domain, the command tells you whether the certificate is there. If it is missing, it names the reason from the log. The certificate can still arrive minutes after the installation. On your own network it checks the connection with the matching root certificate.

Look up the first login

sudo cat /opt/smitey/SMITEY-credentials.txt

After the first login change the password and delete the file.

Are the containers running?

sudo podman ps

Shows every part of the system with its state.

Follow the log

sudo podman logs -f container-backend-1

Shows live what the backend reports. Stop with Ctrl+C.

Check the supervisor

systemctl status smitey-supervisor

This service keeps the system running and applies updates you trigger inside the application.

Create a support bundle

sudo bash /opt/smitey/install.sh --support-bundle

Collects logs and system state into one zip file. Passwords and keys are removed.

Change the public address

sudo bash /opt/smitey/install.sh --reconfigure

Sets a new domain and restarts, so the certificate is requested for the new name.

Change how SMITEY is reached

sudo bash /opt/smitey/install.sh --change-access

Switches between the five options, for example from HTTP to HTTPS. Enter alone keeps the current option. Your data stays.

Remove it

sudo bash /opt/smitey/install.sh --uninstall

Asks about data and about Podman separately – nothing is deleted without asking.

Backups are handled by /opt/smitey/Backup/TicketSystemBackup (list, backup, restore); the daily backup runs on its own. Details are in /opt/smitey/docs/en/BACKUP-RESTORE.txt.

Back to the feature comparisonThe images are taken from version 1.3.1.