Last updated Sep 23, 2026

Stand up a customer's whole workspace for them — company, seats, and every user invite — in one step, so Customer Success can onboard a paying account without sending them through self-service signup.

Who this is for: CoverGuard Customer Success and staff (internal only). Where: Admin → Companies (/admin/companies). Time: ~3 min.

Internal staff only. This surface is visible to CoverGuard super-admins; regular customers never see it.

Why this matters

Some deals need a human touch — a brokerage buying twenty seats wants their team set up and ready, not a signup form. This lets you create the customer's company, grant it the seats it's owed, and invite everyone at once. The company is owned by the customer's account, so it's a real, independent workspace — not tied to CoverGuard — and everyone lands in a ready-to-use instance with onboarding waiting for them.

Before you start

The customer's owner email (the person who'll run the account) — a real work email, not a CoverGuard address.
The list of users to invite and whether each is a plain member or a team admin.
How many seats the deal includes (leave blank to auto-size).

How to provision a company

Go to Admin → Companies (/admin/companies).
Under Provision a company, enter the company name.
Enter the owner: their email, name, and the account type that best fits them (agent, mortgage, insurance, or company admin).
Set the comped seats, or leave it blank to auto-size to the owner plus the users you invite (minimum five).
Add each user to invite with their team role — Member for everyday users, Admin for someone who should also manage the team. Use Add for more rows. To onboard a whole roster at once, click Bulk add and either:

Upload a CSV — click Upload CSV or drag the file onto the panel. A spreadsheet exported straight from the customer's HR system or CRM works as-is, up to 25MB: give it an `email` column and it's read column-by-column, so names, phone numbers, and departments in the other columns are simply ignored. Add an optional `role` column to set individual roles from the file — a cell reading admin makes that person a team Admin, member makes them a Member, and anything else (including a job title like Loan Officer or Agent) takes the default role you choose, so a column of job titles is never mistaken for team permissions. A street-address column named Address is likewise never mistaken for the email column. Semicolon- and tab-separated files, quoted fields ("Smith, John"), and Excel's CSV UTF-8 export are all handled. Upload more than one file if the roster arrived in pieces; anyone listed twice is added once. Each file shows how many addresses it contributed, and Preview lists exactly who would be added before you commit.
Paste the addresses — one per line, or comma/semicolon separated, straight out of a spreadsheet or an email thread.

Either way, pick the role to apply to everyone the file didn't specify, review the running count (new · already listed · duplicates · invalid), and click Add users. Names are ignored, and duplicates and invalid addresses are skipped automatically. Everyone added becomes an editable row, so you can still fine-tune an individual role before you provision. A company tops out at 200 invited users — if a file carries more, the panel tells you how many will be added and the rest are skipped.

(Optional, for bigger accounts) Build the customer's org chart up front — expand Enterprise org chart (optional) — locations & teams:

Add a location (branch/office) with a name and optional city/state.
Add teams inside a location, and add the people who belong to each location or team.
Tick Location manager or Team lead on a person to make them that unit's manager — they'll be able to run their branch or team without company-wide admin.
Everyone here counts toward the seat auto-size, alongside the company-level invites above.

(Optional) Finish their setup in the same pass — expand AI key, billing & API access (optional):

Paste the customer's AI API key to put the whole company on their own AI account.
Paste their Dynamics account id to link their billing record.
Tick Issue a partner API key to give the customer a working key for the CoverGuard API. Give it a name they'll recognise (it starts as Production) and pick a lifetime. Each is applied after the company is created, and each reports its own result. Leave them blank to do it later from the company's detail view.

Optionally add an internal note (for your own records — the customer never sees it).
Click Provision company.

What you'll see / What it means

The owner gets a "your workspace is ready" email with a link to set their password and sign in.
Each invited user gets a team invitation email to claim their seat, set a password, and start using the platform.
The company is granted a Team plan at no charge — a genuine, full-access workspace. Because it's comped, it never counts toward revenue reporting (it shows as $0 MRR and appears as a comped company on the health dashboard).
Every provision is recorded in the audit trail, attributed to you.

Each user's result is shown right after you submit — Invited (a new invite went out), Linked (they already had an account and were added), or Error (for example, they already belong to another company). One problem row never blocks the rest.

If you built an org chart, the locations and teams are created and each person is placed in theirs (with their manager/lead role) as they're invited. It's best-effort per node — if one location or team can't be created, its people are still invited, just unplaced — and the customer can adjust the whole chart afterward under Account → Settings → Team.

If you filled in the AI key or Dynamics account id, each reports separately — connected, or a plain-language reason it didn't take. Either way the company is real and the invites have gone out; a failure there is a follow-up you finish from the company's AI key & billing panel, never a reason to re-provision.

If you asked for a partner API key, the key appears right under the result — copy it then. It's the only time it's shown: CoverGuard keeps a fingerprint of it, not the key itself. Click Copy, send it to the customer through your secure channel alongside their welcome email, then click I've stored it — hide the key. The panel won't let you provision another company until you've hidden it, so a key can't be cleared before you've stored it. If the key couldn't be issued — for example, the owner's account is disabled — the result says why, and you can issue one later from the company's Partner API keys section (below).

Two things to know:

Provisioning the same company again with the box ticked issues another key — it doesn't replace the first one. Untick it when you're re-running provisioning just to add people.
If provisioning takes too long (usually a very large list of people), the page tells you the request didn't finish and unticks the key for you. The company may still have been set up, so check it on the list first. CoverGuard tries to revoke any key that was issued after the page had already given up, but it can't always manage it — so open the company's Partner API keys, revoke any key you didn't receive, and issue a fresh one from there.

The company appears on the Companies tab immediately — as do companies that signed up through self-service, so you can set up any customer's AI key and billing link from the same place.

Issuing the company's API keys

If the customer is connecting their own systems to CoverGuard, you can create their API keys for them — no need to walk them through the Developer settings. The first key can be issued as part of provisioning (step 7 above); for every key after that, or if you skipped it:

On the Companies tab, open the company.
Find Partner API keys. The badge at the top tells you straight away whether the company can have one — Plan includes API access, or No API access with the reason.
Give the key a name the customer will recognise (for example Production CRM sync), pick a lifetime, and leave all scopes ticked unless they've asked for a narrower key.
Click Issue key, then Copy the key and send it to the customer through your secure channel.

The key is shown once. CoverGuard keeps a fingerprint of it, not the key itself, so it can't be shown again. If it's lost, revoke it and issue another — that takes seconds.

What to know about the keys you issue:

They belong to the company, not to you. Each key is owned by the company's owner and tied to the company, so it keeps working exactly as long as the company's plan does. If the plan lapses or is revoked, the key stops working on its next call — you don't have to remember to revoke it.
Only companies on a plan with API access (Team) can have one. If the badge says No API access, comp or upgrade the company's plan first, then come back.
The owner's own account has to be in good standing too. Keys belong to the company's owner, so if the owner's account is disabled — or the owner has their own personal plan that's below Team, which takes precedence over the company's — the panel tells you and won't issue a key until it's fixed.
A key marked "Owner left company" belongs to someone who is no longer a member. It doesn't work for this company any more; revoke it if it isn't moving with them.
You'll see every key the company has, including the ones its members created themselves. If the panel says some member keys "aren't listed here yet", they're working — they appear after their next call.
Revoking is two clicks (the bin icon, then Revoke) and takes effect on the key's next call. Any webhooks that key set up are switched off at the same time.

Turning a company off

Every provisioned company shows a Revoke control on its row in the list. Revoking cancels the comped plan — the owner and everyone on their team drop to the free tier on their next action, and the company's API keys stop working on their next call. Use it when a trial ends or a deal doesn't close. The company and its users aren't deleted; only the free-of-charge access is removed (you can re-provision to restore it).

Tips

Re-run to add users later. Provisioning the same company again is safe — it keeps the existing company, only invites the new people, and never reduces the seat count.
Seats are the limit. If you try to invite more users than seats, the extra invites won't go out — bump the seat count and re-run.
The owner and every user set their own passwords from the emails — you never handle their credentials.
Turn on company AI keys first. If you're going to paste an AI key, check that Company & personal AI keys is on in Platform setup at the top of the Companies tab — while it's off we refuse to store a key rather than let you believe it took.
The owner must be a fresh customer. You can't make a CoverGuard staffer, a platform admin, or someone who already runs a company on CoverGuard into a concierge owner — pick an email that isn't already an owner elsewhere.

Troubleshooting / Common questions

"The owner didn't get an email." → Check Admin → Email delivery for the outcome. A failed row usually means the sending domain isn't verified; all skipped means email isn't configured on this deployment.
"I can't use a coverguard.io address as the owner." → That's intentional — the owner must be a real customer account so the company isn't tied to CoverGuard.
"The owner already belongs to another company." → A person can be in one company at a time. Use a different owner email, or remove them from the other company first.
"That email already runs a company / is a privileged account." → You can only make a fresh customer email the owner — not someone who already owns a self-service company, and not a CoverGuard staff or admin account. Pick a different owner email.
"Issue key is greyed out." → The company's plan doesn't include API access — the note above the form says why. Comp or upgrade the plan, then reopen the company.
"It says it couldn't confirm the plan." → We couldn't check the company's plan just then, so we didn't issue a key rather than guess. Close the company and open it again.
"The customer lost their key." → Revoke it and issue a new one; the old one can't be recovered.
"Which customers will break when API enforcement is switched on?" → The Partner API access panel at the top of the Companies tab lists every integration that would be refused, who owns it and why. A zero headline number is the go-ahead for switching enforcement on — with one caveat: an integration is only checked when it is used, so a key nobody has called since the check went live won't show up until its next call. Before switching, ask any customer with a rarely used integration to make one test call.
"A user shows as billed but the company is comped." → Comped companies never appear in revenue reporting (they read as $0). If you need to stop the free access, use Revoke on the company's row.

Do this next

Inviting users (invite-only signup) — invite a single person to sign up, without creating a company.
Teams, seats & billing — how seats, roles, and inheritance work once the company is live.
Setting up a company's AI account and billing sync — the full AI-key and Dynamics setup, and the platform switch that enables it.
Platform admin & observability — where comped companies show up on the health dashboard.

Back to all guides

Setting up a customer company (white-glove)