Renewal pipeline (Pro/Central expiring within 90 days)
Not yet contacted
--
Reminded
--
PO received
--
Renewed
--
Renewal rate (last 12 months): --
Prospect pipeline
New
--
Contacted
--
Interested
--
Demo booked
--
Not interested
--
Installed
--
By edition
Loading...
Connector usage (active installs, 30d)
Loading...
Pending & recent requests
Loading...
"Book a demo of Central" enquiries submitted from a MAT's dashboard. A simple
new/contacted/closed status tracks follow-up -- unlike a Key Request, an
enquiry doesn't mint anything, so there's no approve/reject workflow here.
Loading...
Trust Roster — the pairing registry a Central hub reads; open when pairing a group
Trust Roster is a separate, manually-tagged pairing registry (distinct from the
GIAS-derived Trusts tab) -- it lets a Central hub ask "who else is in my group" via
its own licence key. Create a roster trust below, then assign licence keys to it from each key's drawer (click the row).
Loading...
🔑 Issue new key
GIAS phase "Primary" → £100/yr; anything else (Secondary, All-through, Special, Nursery, PRU/AP, or an unknown URN) → £250/yr — deliberately erring toward "ask if this looks wrong". Leave on Auto and the Worker looks the URN up in the GIAS register; override for the edge case it gets wrong. Recorded on the licence row for renewals, never signed into the key — a price change never needs a re-issue.
Max spoke schools this hub may aggregate. Leave 0 / blank for unlimited.
The trust's DfE Group UID (Trusts tab / GIAS "Trusts (code)"). Signed into the key so a spoke can verify which hub it's really talking to (TM-04). Leave blank if unknown -- the mismatch check simply stays silent until it's set.
🔍 Verify key
Issued keys
Loading...
Loading...
UK Academy Trusts. Registered trusts have at least one Groundskeeper install
heartbeating in — Central means a non-revoked Central hub key is registered
against the trust, Community only means its schools run unlicensed/Community installs
with no Central hub yet (an upsell signal). Prospect trusts are known to the DfE GIAS
register but have no install yet — a target list for outreach, with the Group UID shown for
cross-reference. The Schools count lets you tell a single-academy trust (1) from a multi-school
MAT at a glance. Click a registered trust to see its schools in the Installs tab.
Loading...
Visibility only -- built from the D5 Central exclusivity registry (specs/CENTRAL_PAIRING.md).
Groups installs by GIAS trust, so a trust with more than one hub currently
claiming it (a school switched hub, or two of our own customers polling the same spoke) and a
trust with a Community-tier install grouped alongside paid ones both stand out
at a glance. Nothing here blocks a poll or a pairing -- this table never gates anything; it is
purely a detection/deterrence aid, populated from the daily heartbeat (a school that has never
heartbeated since the D5 heartbeat extension shipped, 2026-07-15, will not appear yet).
Loading...
Shows UK schools from the DfE GIAS register that have not yet installed Groundskeeper.
Use the CRM status and notes to track your outreach pipeline.
Importing...0%
Load GIAS data to see prospects.
Community feedback board moderation. Merge duplicate suggestions to combine their votes.
Promote high-value suggestions to a GitHub Issue in the public repo
(requires GITHUB_TOKEN Worker secret). Declined and merged suggestions are hidden from the public board.
0 selected
Loading...
📋 Admin audit log
Every change made through this panel -- keys issued or revoked, requests approved or rejected, notes and statuses changed, backups downloaded -- with who did it (from your Cloudflare Access login), when, and from where. Reads are not recorded. Newest first, last 300.
Loading…
💾 Data backup
Downloads a JSON backup of all critical D1 data: licences, installs, key requests, prospect CRM notes, feedback suggestions, invoices and the CRM history.
Licences — all issued keys and revocation status
Installs — all heartbeating schools and CRM data
Key requests — full history including approved keys
Prospect notes — CRM status and notes per school
Feedback suggestions — community board data
Invoices — what was raised, when it was due, when it was paid
CRM history — activity timelines, follow-ups, reminder sends, Central enquiries, roster trusts, the audit log
Quotes, Outgoings, Promotion, FreeAgent links, Central pairings, the panel's settings and the Canary counts — not the FreeAgent keys (reconnect instead)
🔒 Access & security
The admin panel sits behind Cloudflare Access (email one-time code, allow-listed addresses -- live since 23 August 2026) and the API behind the shared secret. Every change made here is recorded on the Audit tab with who made it.
Current auth: shared EJJ_ADMIN_SECRET (Worker secret)
Cloudflare Access in front of this panel — email OTP, live since 23 August 2026
Sessions: a secret cached in this browser
GitHub Issues: GITHUB_TOKEN Worker secret required for promote feature (expiry under GitHub tokens below)
✉ Weekly digest
Sends the weekly ops digest email immediately. The scheduled cron runs automatically every Monday at 08:00 UTC.
Active installs, new this week, gone silent
Pending key requests & expiring licences
Multi-install flags with age
Version breakdown across active installs
✉ Test email deliverability
Sends a sample licence-key email (the real template, with a dummy key) to any address via Resend — the exact path Community keys use. Use it to check inbox-vs-spam placement, or to reproduce a “didn’t receive it” report from a specific tenant.
⚙ Community auto-issue
When ON, key requests from recognised school/MAT domains are minted and emailed instantly. When OFF, every request — school domains included — is held in the Key Requests queue for manual approval instead. A no-redeploy kill switch if auto-issue is ever abused. Consumer/webmail domains are always queued regardless of this setting.
RSJ Software — Admin Panel