Where the work gets done

Every request a client raises lands as unsorted. That is deliberate: the client is telling you what happened, not what kind of work it is. Sorting it is your call.

Open the request and use the Sort dialog. You pick what it actually is (an Issue, a Feature Request or a Change Request), and you can add a free-text sort reason if the decision needs explaining. The reason is optional, but it is the cheapest way to stop the same argument happening twice.

The converted record keeps what was already there: title, description, status, priority, due date and privacy level. The client’s comments and files carry over with it, so nobody has to repeat themselves and the conversation stays attached to the work.

Who sorted it is stamped on the record, and the project’s members are notified that it exists. From that point it is a typed record in a tracker, and it gets worked like everything else.

Client requests have their own short life: they arrive unsorted and stay there until triage sorts them into an issue, a feature request or a change request.

From there, issues, feature and change requests and tasks all move through the same seven statuses, and they cover the states real work is actually in: open, in-progress, pending-review, need-meeting, rejected, cancelled and closed. Three of those (closed, rejected and cancelled) are terminal. Everything else can still move.

need-meeting and pending-review exist because work stalls for honest reasons. A record waiting on a conversation is not the same as a record nobody has started, and saying so out loud saves you the status meeting.

Priority is separate and has four levels: low, medium, high, urgent.

Requests, issues and feature and change requests live in filterable tracker lists: search, filters, stat tiles you can tap to narrow the list. Tasks sit on a board instead, one column per status, and dragging a card to another column changes its status. If you want a view of just your own work, My Issues gives you a personal list plus a Calendar tab for what is due when.

Yes. Every item carries a privacy level: internal or external. Set it to internal and the item disappears for external users, which is to say anyone on a client role.

Hidden means hidden everywhere it matters, not just from the list. Internal items are excluded from the records a client can load, from the counts and stat tiles they see, and from the notification fan-out, so nobody gets pinged about a record they are not allowed to open. It is enforced on the server, so there is no address to guess and no response to inspect.

Privacy carries through triage conversion. If an unsorted request was internal, the issue or feature request it becomes is internal too. You do not have to remember to reapply it at the moment you are least likely to be thinking about it.

If you want the client’s side of this, see the client portal FAQ.

Each project has a Task Tracker, laid out as a board with a column per status: drag a card to another column to move it, and the board scrolls as you near the edge. Tasks are the internal breakdown of the work: they are not client-facing, and they do not have to map one-to-one onto a record a client raised.

A task can hold several assignees rather than one, and so can a subtask. Real work usually has more than one person on it, and forcing a single owner just means the other people involved find out by accident.

Task notifications go only to the people assigned. Nobody else on the project gets pulled in.

Personal Tasks are separate and private to you. Your own list, with notes and file attachments that no one else can see: the things you need to remember but nobody needs to be notified about.

Malaysian and Singaporean ones, and nobody has to keep the list. They appear in amber: the day is washed, a slim label sits under the date, and the office is in brackets where a holiday belongs to one office rather than to all of them. The full name is on hover.

A holiday is nothing to open and it is counted nowhere, because it is what the day is rather than something sitting on it.

The same days are used everywhere else that needs to know. An attendee reads Holiday when you try to schedule over one, a client’s own calendar carries them too, and a streak on the team feed treats a public holiday, a weekend and approved leave as neutral rather than as a break in the run.

It means that person already has something on the calendar in the slot you are looking at. While you are setting up a meeting, every attendee you have named reads Free, Busy, On leave or Holiday for the chosen time, so a clash is visible before the invitation goes out rather than after it.

What it will not tell you is what they are busy with. Titles stay private: the answer is availability and nothing more, which is the difference between a scheduling aid and a window into somebody else’s diary.

The same word turns up in a second place and means something slightly different there. The status pill in the top bar reads Available, Busy or Away and puts itself on Busy while you are in a meeting or running a timer. That one is about right now; free and busy is about the slot you are choosing.

Time is tracked against the item somebody is working on rather than against the project as a whole, and it is measured in man-days: one man-day is four hours. Tasks, issues and feature or change requests can be tracked. Personal tasks and client requests cannot, because neither is contracted project work.

One timer runs at a time. Start it from the Time block on the item and a pill appears in the top bar carrying the running clock and the item it belongs to, so it follows you around the app instead of living on the page you started it from. Starting a timer on a second item stops the first one for you and tells you what it recorded. Anything under a minute is treated as a misclick and nothing is saved.

Time you already spent goes in by hand with Log time, either as hours and minutes on a date or as a start and an end read in your own time zone. An entry has to be at least a minute and at most twelve hours, it cannot end in the future, and it cannot be backdated more than thirty days.

My Time is where it gets reconciled. Entries are grouped by working day with what each one counted, and a day heading carries a confirm for everything on it that is still waiting. Entries a safety layer closed for you are flagged, and they count towards nothing until a person confirms or corrects them. Days follow the company timezone, the same days a project is billed in, so a late night lands on the day it started.

Manual maintenance hour logs are retired. Old logs are kept as read-only history and nothing can be added to them, because the spend against a contract is now read from the time tracked on the work itself.

A project with a contracted man-day total gets a Time tab: what has been used against what was sold, with a budget meter, and breakdowns by item and by person. Alerts go out once each at 80, 90 and 100 percent of the contract, to the people configured per threshold.

Nothing is ever blocked. Time past the contract is kept in its own overage bucket that an admin acknowledges, which is a record that somebody saw it rather than a gate.

The same tab shows how much of the project went on rework. Closing an issue can record why it existed, choosing between a defect of ours, an ambiguous spec, the client environment or a third party, and those answers are what the rework split is made of.

Where a project also has a maintenance agreement, the tab shows this month’s tracked time against the monthly allowance, with the window it is measured over.

It closes itself, and it does not quietly count. Six hours is the ceiling for a timer started in the app, and a tab that goes quiet is closed back to the last moment it was known to be there rather than the moment somebody noticed. A timer an agent starts gets two hours instead, because there is no open tab to vouch for it.

Either way the entry is marked as needing review. It sits in My Time with an amber edge and the reason it was closed, and it counts towards nothing at all until you confirm it as it stands, correct the times, or delete it. Anything still unconfirmed after 48 hours is flagged and has its own filter.

That is why a project total can look low. It is usually an entry waiting for review, not missing work.

Go to Settings → MCP Connection. Generate token mints a token beginning chd_, and it is shown exactly once. Only a hash is stored, so if you lose it you generate another rather than recover it.

The card lists every token you hold with when it was created and when it was last used, and a Revoke button next to each. Revoking cuts access immediately.

The built-in Connection guide on the same page has tabs for Claude Code, Claude Desktop, Cursor and other clients, with the exact config for each and your deployment’s MCP endpoint shown right there, so you are copying a value, not looking one up.

claude.ai custom connectors work differently: instead of pasting a token you go through an OAuth sign-in-and-consent flow. The token that flow mints appears in the same list, with the same Revoke button. There is one place to see what has access, whichever way it was granted. And if you want the shape of what agents do once connected, that is here.

Over forty tools, covering most of what you would otherwise do by clicking. An agent can search, list your work and your notifications, list organisations, projects and items, read and create issues and feature/change requests, file a client request, comment, change status, create, update and delete tasks, manage your personal tasks, start and stop a timer, log time already spent, read the running timer, pull a time summary, read the project tracker and post a weekly update, read and fill in the custom sheets on the Projects page, list the credentials about to expire or record a new one in a project’s secrets register, and call whoami to check who it is acting as.

Assignment works in plain language. “Assign this to Farah” resolves the name. You do not hand your agent a user ID, and you do not go and find one yourself.

The permissions are the honest part. An agent holds exactly the permissions of the user whose token it carries: the same role matrix, the same project membership, nothing more. It cannot see a project you are not a member of, and it cannot see an internal item you could not see. Every write is attributed to that user, and title and description edits by an agent are recorded in the same edit history as edits made in the browser and kept with the record.

Three limits worth knowing up front. The token’s role needs team workspace access, so a client role cannot use MCP at all. File attachments are not supported over MCP; those still go through the web app. And a timer an agent starts closes itself after two hours rather than six, because there is no open tab to vouch for it: the entry then waits for a person to confirm it before it counts towards anything.

Only when there is nothing to decide, and only where the feature is enabled for your deployment, which happens on request. Every client request is read on arrival and given a type and a priority. If that reading matches the type the client already suggested, the request is filed as an issue or a feature or change request straight away, and the record is stamped as sorted by AI with the reason on the chip.

Everything else is held. That covers three cases: the reading disagrees with the client’s own suggestion, the client suggested no type at all, or the request is not delivery work and needs a person for another reason. A held request sits in the queue with one sentence saying why, naming what the AI thought it was and what the client said, so whoever picks it up starts from an argument rather than a blank form.

A request the client marked urgent keeps that priority. The AI only ever answers low, medium or high, and applying its answer would quietly demote the request, so it does not.

If the classifier cannot be reached it is retried once and then the request is held, marked as unavailable. It never guesses a category to fill the gap. You can re-run the classification on any request from the record, and ask for an advisory second reading on an item that is already filed.

Notifications are real web push, not a badge that only appears while the tab is open. Enable them in Settings, and if you install the app (Add to Home Screen on iPhone and iPad), they reach your phone the way any other app’s do. There is a “Send test notification” button, and it exercises the whole delivery chain rather than faking a toast in the page, so if it arrives, the real thing will arrive too.

Two shortcuts do most of the work. ⌘J opens universal search from anywhere: records, projects, people. ⌘\ toggles the sidebar when you want the screen back.

Dark mode and font size are in Settings. Both persist, and the font size setting is a real size change rather than a browser zoom, so nothing else on the page breaks when you use it.

On an Error Log page in the team workspace, newest first, kept for thirty days. Each row carries when it happened, the response status, the error and its message, and the request that triggered it. Opening a row shows the stack trace underneath.

Reading it is a permission and so is clearing it. The menu item is not there at all for roles without read, and clearing the whole log is kept to senior roles, with no undo.

To be plain about the boundary: this is the product’s own record of what failed while serving your team, which replaced a fixed email list. It is not a place to send errors from your own applications.

A page of its own, reachable from the event on the calendar. It carries when the meeting was and how long it ran, who came and whether there is a recording, and a Who was there timeline giving each person their time in the call with drops and rejoins included. The name and the notes are editable on the page itself.

Three things sit beside that. The transcript, which interleaves the spoken captions and the messages typed in the room into one account of the meeting. The recording, where somebody made one, with its length and size under the player and a download button. And the write up, which starts on its own when the meeting ends and comes back with an overview, the decisions, and action items with owners.

Linked to is the part that joins the meeting to the work: a meeting can be linked to issues, feature requests, change requests or an organisation, and each linked issue records the meeting in its own history. A repeating series keeps one record per occurrence, so every run gets its own transcript window and its own summary rather than one summary trying to cover the lot.

Press Command and J, or Control and J, anywhere in the workspace and start typing. One box searches the lot: pages, including any you have hidden from your own sidebar, chats by name, issues, feature requests, change requests and client requests, meetings, personal tasks, organisations and projects.

Results are grouped by what they are and reachable with the arrow keys, so the whole thing works without touching the mouse.

What it reads is names, titles and references rather than the words inside a conversation, so it will find a chat room by its name and not by something somebody said in it. Everything it offers is already inside your own permissions: a record you could not open is not a result that fails when you press it, it is not a result at all.

Chat is rooms with members. You add the people who need to be in the conversation, attach files where a screenshot says it faster, and messages arrive live over an open socket rather than on a polling delay.

Your team manages the rooms: add people, remove them, delete a room that has served its purpose. On mobile, long-press a message to get its actions rather than hunting for a hover menu that was never going to appear.

Connections drop on trains, in lifts, on hotel wifi. When yours comes back, edits and deletes you missed while away are recovered, so you are not left reading a version of the conversation that no longer exists.

Yes. Two switches in Settings hide whether you are online and when you were last seen. Hiding your last seen means it is not sent to colleagues’ screens at all rather than hidden once it has arrived, which is the only version of that promise worth making.

There is a fair trade attached: hide yours and you stop seeing other people’s, because a one-way mirror is not a privacy setting. Everything else about being reachable carries on working. Messages arrive, notifications arrive, and a meeting still records that you were in it.

Separately from all of that, the status pill in the top bar is yours to set. It reads Available, Busy or Away, it puts itself on Busy while you are in a meeting or running a timer, and when the automatic answer is the wrong one you can set it for an hour, for four hours, or for the rest of the day, which ends at 7:00 PM Singapore time (or 7:00 PM tomorrow if you set it after hours).

Online itself means somebody is actually there: the app is on a screen in front of you and has had a key, a click, a scroll or a touch in the last five minutes. A laptop left open on a desk goes grey rather than staying green all night, and last seen follows the same rule.

Yes. A meeting carries a join link unless somebody deliberately takes it off, and anybody holding that link can open it in a browser. Some links are not on the calendar at all: the team can create one to hand out and nothing else. There is no account to create and nothing to install: a guest gives a name, checks their camera and microphone, and asks to join.

They do not walk straight in. A guest waits on a screen that says they are waiting to be let in, and a team member already in the call decides, with Let in or Not now. Whoever is waiting is listed in the corner of the call and announced as they arrive, so nobody is left knocking at a door nobody is watching.

A link is not a standing door. Where the meeting has a time on the calendar, guests can open it from fifteen minutes before the start until four hours after it, and any time while the meeting is actually running. A link with no day behind it waits until somebody on the team walks in and opens the room. Every link stops working altogether once the meeting has ended. A code with a character wrong in it, one that never existed and one for a meeting that was called off all get the same answer, so somebody guessing at codes learns nothing from the reply, and too many tries in a row are turned away without a reason.

Guests are visitors and nothing else. They see the call, the people in it and what is typed while they are there, and they get no way into the rest of the workspace.

Never automatically. A meeting is recorded only when the person who set it up starts a recording, and nothing at all is captured until they do.

While one is running, everybody in the call knows. A Recording notice sits across the top of the screen for the whole time, naming whoever started it, and a red dot stays in the header beside it. Guests see the same notice, and both the screen before joining and the waiting screen say in advance that the host can record and that a notice will appear if they do.

What was recorded belongs to the team. It is kept in the team workspace, on the page for the meeting’s own day on the calendar, beside who attended and what was typed in the chat, where it can be played back or downloaded. Guests get no way back to any of it, and deleting a recording is its own permission rather than something everyone who can start one also holds.

Because listing and opening are different permissions. A role can be allowed to see every project in an organisation while membership still decides which ones you work in. That is deliberate: the list tells you the organisation’s shape, membership decides what you touch.

Opening one you are not on shows an access screen with the project name and the organisation it belongs to, not a raw error. Write an optional note, ask for access, and everyone who can decide it is notified in the app, by push and by email. The screen then says a request is waiting, with the date.

A decline shows the reason if one was given and offers another attempt. Asking is capped at twice a day for the same project and five times in total, after which it points you at an administrator, who can add you directly.

If you are not in the organisation at all there is nothing to ask for, and the screen says so. Whoever creates an organisation or a project is a member of it from the start, so this never applies to your own.

The app updates itself and then tells you. An update found while it is starting applies right away; one found mid-session applies the next time you come back to the tab, never while you are typing. There is no prompt to accept and nothing to refresh.

After the version changes, a short What’s new dialog lists what shipped in it, once per version, filtered to the lines your own module can see. The same notes for every release are on our changelog.