Admin Guide

Organization Management

An organization is the top-level container in Karnyx. All users, meetings, recordings, and settings belong to exactly one organization. The first user to sign up creates the org and becomes the Owner.

Organization Settings

Navigate to Settings > Organization to manage core org-level settings:

• Display name: Your company or team name, shown in shared summaries and exports.
• Default timezone: Used for meeting scheduling and report generation when a user has no timezone set.
• Logo: Upload a company logo for branded exports and the login screen (Enterprise plan).
• Allowed email domains: Restrict sign-ups to specific domains (e.g., @yourcompany.com). Users with non-matching emails cannot join.
• Default capture mode: Set whether new users default to Ghost Mode or Bot Mode for meeting capture.

Inviting Users

Owners and Admins can invite users via Settings > Members > Invite. You can invite by email address or share an invite link. When using SCIM directory sync, users are provisioned automatically.

// Invite via API
POST /api/v1/org/invites
{
  "emails": ["alice@company.com", "bob@company.com"],
  "role": "MEMBER",
  "message": "Welcome to Karnyx! Connect your calendar to get started."
}

// Response
{
  "invites": [
    { "email": "alice@company.com", "status": "sent", "expires_at": "2025-02-17T14:30:00Z" },
    { "email": "bob@company.com", "status": "sent", "expires_at": "2025-02-17T14:30:00Z" }
  ]
}

Roles & Permissions

Karnyx uses a four-tier role system. Each user in the organization is assigned exactly one role. Roles are hierarchical: higher roles inherit all capabilities of lower roles.

SSO Setup

Karnyx supports Single Sign-On via SAML 2.0 and OpenID Connect (OIDC), powered by WorkOS. SSO is available on the Pro and Enterprise plans.

SAML 2.0 Configuration

1. Navigate to Settings > Security > Single Sign-On.
2. Click "Configure SAML".
3. Copy the ACS URL (Assertion Consumer Service) and Entity ID from the Karnyx setup screen. You will need these in your identity provider.
4. In your IdP (Okta, Azure AD, OneLogin, etc.), create a new SAML application and paste the ACS URL and Entity ID.
5. Download the IdP metadata XML or copy the SSO URL, Certificate, and Issuer values.
6. Paste the IdP metadata into the Karnyx setup form and click "Save".
7. Test the connection by clicking "Test SSO Login". This opens a new browser window and attempts to authenticate through your IdP.

// SAML configuration values provided by Karnyx
{
  "acs_url": "https://auth.karnyx.ai/saml/acs/org_k2l3m4n5",
  "entity_id": "https://auth.karnyx.ai/saml/org_k2l3m4n5",
  "name_id_format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "attribute_mapping": {
    "email": "user.email",
    "first_name": "user.firstName",
    "last_name": "user.lastName",
    "department": "user.department"
  }
}

OIDC Configuration

For identity providers that support OpenID Connect (Google Workspace, Auth0, etc.):

1. Navigate to Settings > Security > Single Sign-On.
2. Click "Configure OIDC".
3. Enter your IdP's Discovery URL (/.well-known/openid-configuration endpoint).
4. Provide the Client ID and Client Secret from your IdP.
5. Click "Save" and test the connection.

SCIM Directory Sync

SCIM (System for Cross-domain Identity Management) allows you to automatically provision and deprovision Karnyx users from your corporate directory. When an employee joins or leaves your company, their Karnyx access is updated automatically. SCIM is available on the Enterprise plan.

Setting Up SCIM

1. Navigate to Settings > Security > Directory Sync.
2. Click "Enable SCIM". Karnyx generates a SCIM endpoint URL and a Bearer token.
3. Copy the endpoint URL and token into your directory provider (Okta, Azure AD, OneLogin, JumpCloud, etc.).
4. In your directory provider, assign the Karnyx application to the groups that should have access.
5. Trigger an initial sync. Karnyx will create accounts for all assigned users.

// SCIM endpoint configuration
{
  "scim_url": "https://api.karnyx.ai/scim/v2/org_k2l3m4n5",
  "bearer_token": "scim_••••••••••••••••••••••",
  "supported_resources": ["Users", "Groups"],
  "operations": [
    "CREATE user  → provisions Karnyx account with MEMBER role",
    "UPDATE user  → syncs name, email, department, and active status",
    "DELETE user  → deactivates Karnyx account (data retained per policy)",
    "CREATE group → maps to Karnyx team for meeting visibility",
    "UPDATE group → syncs group membership changes"
  ]
}

Data Retention Policies

Karnyx allows organization Owners to configure how long meeting data is retained. These policies help you comply with internal governance requirements and regulations like GDPR.

Configurable Retention Categories

Configure retention policies in Settings > Organization > Data Retention. When data reaches the end of its retention period, it is permanently and irreversibly deleted from all Karnyx systems, including backups, within 30 days.

Audit Logs

Karnyx maintains a comprehensive audit trail of all significant actions within your organization. Audit logs are immutable and cannot be modified or deleted by any user, including Owners.

Audited Events

• User sign-in and sign-out (including SSO and failed attempts)
• User invitation, role change, deactivation, and deletion
• Meeting capture start and stop
• Meeting data access (who viewed a transcript, summary, or recording)
• Meeting data export and sharing
• Integration connection and disconnection (calendar, Slack, webhooks)
• Webhook creation, modification, and deletion
• SSO and SCIM configuration changes
• Data retention policy changes
• Organization settings changes
• API key creation and revocation

Log Entry Format

// Example audit log entry
{
  "id": "aud_r3s4t5u6v7",
  "timestamp": "2025-02-10T14:32:15Z",
  "actor": {
    "user_id": "usr_a1b2c3",
    "email": "admin@company.com",
    "role": "ADMIN",
    "ip_address": "203.0.113.42",
    "user_agent": "Karnyx Desktop/1.2.0 (macOS 14.3)"
  },
  "action": "user.role_changed",
  "resource": {
    "type": "user",
    "id": "usr_d4e5f6",
    "email": "alice@company.com"
  },
  "details": {
    "previous_role": "MEMBER",
    "new_role": "ADMIN",
    "reason": "Promoted to team lead"
  }
}

Exporting Audit Logs

Audit logs can be exported as CSV or JSON from Settings > Security > Audit Logs > Export. You can filter by date range, actor, action type, and resource type before exporting. On the Enterprise plan, you can also stream audit logs to an external SIEM via a webhook.

Usage Limits by Plan

Each Karnyx plan includes different limits for meetings, storage, and features. The table below shows the limits for each plan tier.