Community Admin Guide

Your console: https://<your-community>.tibova.my/urus.

1. Signing in for the first time

1. Open the e-mail "You are invited to manage … on Tibova" and press Accept invitation. The link is valid for 7 days.
2. Choose your own password and tick the PDPA consent.
3. Sign in at <your-community>.tibova.my/urus with that e-mail and password.
4. Set up 2FA: scan the QR code with an authenticator app (Google Authenticator, Authy) and keep the recovery codes safe.

Link expired? Ask Tibova to send the invitation again. A fresh link goes to the same e-mail.

Forgot your password: press Forgot password on the sign-in screen. It only works once the account has been activated through the invitation link.

2. The menu

What you see depends on your role. On a phone, the menu is behind the ☰ button at the top.

3. Connecting the gate controller

Done once, usually with the installer. Open Access & Gate › Controller Connection.

1. Press Open Commissioning Mode and follow its 8 steps.
2. Paste your community's Nuveq API key (from the installer or the Nuveq portal), then test the connection.
3. Choose the right site, access group and doors for the main gate, the pedestrian gate and the lifts (if any).
4. Finish every step. The controller's status changes to connected.

• Webhook Health shows whether events from the gate reach Tibova. An event that cannot be verified is marked "suspected spoof" and never deleted.
• Credential Pool keeps recycled card and QR numbers safely. A full number is never displayed.

Gate kiosk tablet: the tablet at the gate is paired by Tibova. Contact us when you install a new tablet or one goes missing.

4. Registering residents

Set up the structure first

Residents & Units › Zone Structure: blocks or streets, and units. Then Parking Bays if you have them.

Adding residents

• One at a time: Residents › + Add One. Fill in the name, phone number and unit.
• Many at once: Residents › Bulk Import (CSV). Upload a CSV that follows the template, check the preview, then confirm.

Each resident receives an invitation on WhatsApp and activates the account with an OTP code. Invitations are valid for 7 days. A bulk import is sent slowly, about 50 invitations every 10 minutes, so the WhatsApp number is not blocked.

Unit claims

Residents who register themselves appear under Unit Claims. Check their details, then Approve or Reject. Until approved, the resident sees "Waiting for management confirmation".

5. Gate, plates & alarms

• Gate Activity: who came in and went out, when, and how (QR, ANPR plate, card). It can be filtered and exported.
• Registered Plates: residents' vehicles that the ANPR camera lets in automatically.
• Alarm Rules: when the system should raise an alert, for example repeated attempts or a gate left open too long.

6. Visitors & contractors

• Visitors: every pass residents have issued. You can cancel a pass or add someone to the blacklist.
• Contractors & Couriers: the companies and workers allowed in, with their working period. For workers, only the name and the last 4 digits of the MyKad are kept.
• Commercial Tenants: shops and premises inside the area.
• Registration Links: public links (for contractors, for example) that can be shared without the app.

Visitors without an invitation (walk-ins)

A visitor without a pass registers on the gate tablet. The resident of that unit receives an approval request in the app or by a WhatsApp link, and taps Allow or Deny.

7. Bills, fees & payments

1. Payment Gateway: connect the merchant account owned by your JMB/MC (Bayarcash, for example). It needs a 2FA code. Money goes straight into the community's bank account, never through Tibova.
2. Record the fee authorisation: Quotas & Limits › Manage Fees & Authorisation. Enter the reference and date of the meeting (AGM/EGM) that approved the fee. A fee cannot be activated without this record (Strata Management Act 2013).
3. Billing: generate and follow residents' bills, and record payments.
4. Quotas & Limits: limits on visitor passes, bookings and more. Residents' requests for more land in Quota Requests.

Arrears can only block facility bookings and new visitor passes. They never stop residents from entering their own home. This cannot be changed.

8. Facilities, complaints & announcements

• Facilities: the hall, courts, BBQ pits and more, with their hours, limits and charges.
• Facility Bookings: residents' bookings, to approve or cancel.
• Resident Complaints: complaints and suggestions from the app. Update the status so residents can see progress.
• Announcements: write notices to residents. They appear under "Latest Notices" and in the ANNOUNCEMENTS block on the app's home screen.

9. Remote Barrier Open

For emergencies only (ambulance, fire brigade, a fault), from the Dashboard.

1. Press Remote Barrier Open.
2. Write the reason (required) and enter your current 2FA code, even though you are already signed in.
3. The barrier opens and the action is recorded permanently with your name, the time and the reason.

Permission: only a role that enforces 2FA can be given this permission (System › Roles & Permissions).

10. Admins, roles & settings

• Admin Users › Invite Admin: invite committee members or office staff. They receive an e-mail with an "Accept invitation" link. An admin still marked "invited" can be invited again to receive a fresh link.
• Roles & Permissions: set what each role may do, and whether 2FA is required.
• Settings: community details, hours, language, data export and PDPA settings.
• Branding: the logo and name residents see.
• Flow Map: diagrams of the 7 main journeys (visitors, contractors, residents and more) for training the committee.
• Guide: this guide.

11. Reports & audit log

• Reports: access, visitor, complaint and collection figures. They can be exported.
• Audit Log: a record of every admin action, including Tibova support sessions. No one can edit or delete a record.

12. What the system will not allow

These are deliberate, to protect residents and the JMB/MC:

• Locking residents out of their own home over arrears.
• Storing MyKad images. Only the name and last 4 digits are kept.
• Activating a fee without a meeting authorisation record.
• Editing or deleting the audit log.
• Opening the barrier remotely without 2FA and a written reason.
• Showing a full card or QR number.

Visitor face photos are kept for 30 days. Access logs are kept for 7 years.

13. Common problems