diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95347033..c0872fcf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,11 +52,17 @@ jobs:
           bundle exec rails db:create
           bundle exec rails db:migrate
 
-      - name: Run tests
+      - name: Run Non-JS tests
         env:
           RAILS_ENV: test
           DATABASE_URL: postgres://postgres:postgres@localhost:5432/access_pdf_test
-        run: bundle exec rspec
+        run: bundle exec rspec spec/models spec/requests
+
+      - name: Run JS tests
+        env:
+          RAILS_ENV: test
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/access_pdf_test
+        run: bundle exec rspec spec/features
 
       - name: Keep screenshots from failed system tests
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index a1949bdf..8c364ab1 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -14,14 +14,14 @@ on:
         description: Inference Model
         options:
           - gemini-2.5-pro-preview-03-25
-          - gemini-1.5-pro-latest
+          - gemini-2.0-flash
+          - gemini-2.0-flash-lite
       evaluation_model_name:
         type: choice
         description: Evaluation Model
         options:
           - gemini-2.5-flash
           - gemini-2.5-pro-preview-03-25
-          - gemini-1.5-pro-latest
       runs_per_document:
         description: 'Number of times generate evaluations per document'
         required: false
diff --git a/.github/workflows/python_components.yml b/.github/workflows/python_components.yml
index b97ba750..da4becc1 100644
--- a/.github/workflows/python_components.yml
+++ b/.github/workflows/python_components.yml
@@ -26,6 +26,7 @@ jobs:
         python -m pip install --upgrade pip
         if [ -f ./python_components/ci/requirements.txt ]; then pip install -r ./python_components/ci/requirements.txt; fi
         pip install python_components/evaluation
+        pip install python_components/document_inference
         python -m spacy download en_core_web_sm
     - name: Run Linting
       run: |
diff --git a/Gemfile b/Gemfile
index 451fcc96..800e5419 100644
--- a/Gemfile
+++ b/Gemfile
@@ -54,6 +54,7 @@ group :test do
   gem "rails-controller-testing"
   gem "factory_bot_rails", "~> 6.5"
   gem "capybara"
+  gem "capybara-email"
   gem "webdrivers"
 end
 
@@ -62,6 +63,7 @@ gem "aws-sdk-s3", "~> 1.194"  # For S3 versioning support
 gem "aws-sdk-secretsmanager"
 gem "aws-sdk-lambda"
 gem "aws-sigv4"
+gem "aws-sdk-ses"
 
 # API and Documentation
 gem "grape", "~> 2.4"
diff --git a/Gemfile.lock b/Gemfile.lock
index 69f4fc7b..ff731c2d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -103,6 +103,9 @@ GEM
     aws-sdk-secretsmanager (1.117.0)
       aws-sdk-core (~> 3, >= 3.227.0)
       aws-sigv4 (~> 1.5)
+    aws-sdk-ses (1.85.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
+      aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.3.0)
@@ -131,6 +134,9 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    capybara-email (3.0.2)
+      capybara (>= 2.4, < 4.0)
+      mail
     cgi (0.5.0)
     chartkick (5.2.0)
     childprocess (5.1.0)
@@ -286,7 +292,11 @@ GEM
     parser (3.3.8.0)
       ast (~> 2.4.1)
       racc
-    pg (1.5.9)
+    pg (1.6.0)
+    pg (1.6.0-aarch64-linux)
+    pg (1.6.0-arm64-darwin)
+    pg (1.6.0-x86_64-darwin)
+    pg (1.6.0-x86_64-linux)
     pp (0.6.2)
       prettyprint
     prettyprint (0.2.0)
@@ -518,6 +528,7 @@ DEPENDENCIES
   aws-sdk-lambda
   aws-sdk-s3 (~> 1.194)
   aws-sdk-secretsmanager
+  aws-sdk-ses
   aws-sigv4
   bcrypt (~> 3.1)
   better_errors (~> 2.10)
@@ -525,6 +536,7 @@ DEPENDENCIES
   brakeman (~> 7.1)
   bundler-audit (~> 0.9.2)
   capybara
+  capybara-email
   chartkick
   cssbundling-rails (~> 1.4.3)
   csv
diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
new file mode 100644
index 00000000..929c7b6f
--- /dev/null
+++ b/app/controllers/admin/users_controller.rb
@@ -0,0 +1,83 @@
+class Admin::UsersController < ApplicationController
+  include Access
+
+  before_action :ensure_user_is_user_admin
+
+  before_action :set_user, only: [:edit, :update]
+  before_action :site_list, only: [:new, :create, :edit, :update]
+  before_action :set_minimum_password_length, only: [:new, :edit, :update]
+
+  def index
+    @users = User.all
+  end
+
+  def new
+    @user = User.new
+    render :new
+  end
+
+  def create
+    @user = User.new(user_params)
+    if @user.is_invited?
+      temp_password = SecureRandom.hex(12)
+      @user.password = temp_password
+      @user.password_confirmation = temp_password
+    end
+    if @user.save
+      begin
+        msg = "User added successfully"
+        if @user.send_new_account_instructions?
+          msg = "User added successfully. Instructions were emailed to the user."
+        end
+        redirect_to admin_users_path, notice: msg
+      rescue Net::SMTPFatalError => e
+        redirect_to admin_users_path, alert: e.message
+      end
+    else
+      render :new, status: 422
+    end
+  end
+
+  def edit
+    render :edit
+  end
+
+  def update
+    if params[:user][:password].blank?
+      params[:user].delete(:password)
+      params[:user].delete(:password_confirmation)
+      params[:user].delete(:current_password)
+      success = @user.update_without_password(user_params)
+    elsif @user.id == current_user.id
+      success = @user.update_with_password(user_params)
+      bypass_sign_in @user, scope: "user"
+    else
+      success = @user.update(user_params)
+    end
+    if success
+      redirect_to admin_users_path, notice: "User updated successfully"
+    else
+      render :edit, status: 422
+    end
+  end
+
+  private
+
+  def site_list
+    @sites = Site.all.order(:location, :name).group_by(&:location).map do |location, sites|
+      [location, sites.map { |site| [site.name, site.id] }]
+    end
+  end
+
+  def set_user
+    @user = User.find(params[:id])
+  end
+
+  def user_params
+    params.require(:user).permit(:email, :password, :password_confirmation, :current_password, :is_site_admin, :is_user_admin, :site_id, :is_invited)
+  end
+
+  def set_minimum_password_length
+    @minimum_password_length = User.password_length.min
+  end
+end
diff --git a/app/controllers/concerns/access.rb b/app/controllers/concerns/access.rb
index 07554a99..b6e0861c 100644
--- a/app/controllers/concerns/access.rb
+++ b/app/controllers/concerns/access.rb
@@ -1,18 +1,24 @@
 module Access
-  def ensure_user_admin
-    unless current_user.is_admin?
+  def ensure_user_site_admin
+    unless current_user.present? && current_user.is_site_admin?
+      redirect_to sites_path, alert: "You don't have permission to access that page."
+    end
+  end
+
+  def ensure_user_is_user_admin
+    unless current_user.present? && current_user.is_user_admin?
       redirect_to sites_path, alert: "You don't have permission to access that page."
     end
   end
 
   def ensure_user_site_access
-    if !current_user.is_admin? && (current_user.site.nil? || current_user.site.id != @site.id)
+    if current_user.nil? || !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.id != @site.id)
       redirect_to sites_path, alert: "You don't have permission to access that site."
     end
   end
 
   def ensure_user_document_access
-    if !current_user.is_admin? && (current_user.site.nil? || current_user.site.documents.find(@document.id).nil?)
+    if current_user.nil? || !current_user.is_site_admin? && (current_user.site.nil? || current_user.site.documents.find(@document.id).nil?)
       redirect_to sites_path, alert: "You don't have permission to perform that action on document."
     end
   end
diff --git a/app/controllers/configurations_controller.rb b/app/controllers/configurations_controller.rb
index a516be67..bf13c4c5 100644
--- a/app/controllers/configurations_controller.rb
+++ b/app/controllers/configurations_controller.rb
@@ -1,7 +1,7 @@
 class ConfigurationsController < AuthenticatedController
   include Access
 
-  before_action :ensure_user_admin
+  before_action :ensure_user_site_admin
 
   ASAP_API_USER = "/asap-pdf/production/RAILS_API_USER-20250613220933079900000001"
   ASAP_API_PASSWORD = "/asap-pdf/production/RAILS_API_PASSWORD-20250613220933080000000003"
diff --git a/app/controllers/sites_controller.rb b/app/controllers/sites_controller.rb
index 8aa19d16..fde11e78 100644
--- a/app/controllers/sites_controller.rb
+++ b/app/controllers/sites_controller.rb
@@ -6,7 +6,7 @@ class SitesController < AuthenticatedController
   before_action :ensure_user_site_access, only: [:insights, :show, :edit, :update, :destroy]
 
   def index
-    @sites = if current_user.is_admin?
+    @sites = if current_user.is_site_admin?
       Site.all
     else
       current_user.site.nil? ? [] : [current_user.site]
diff --git a/app/controllers/users/passwords_controller.rb b/app/controllers/users/passwords_controller.rb
index 9f2d9aee..ce8cd164 100644
--- a/app/controllers/users/passwords_controller.rb
+++ b/app/controllers/users/passwords_controller.rb
@@ -2,34 +2,18 @@
 
 class Users::PasswordsController < Devise::PasswordsController
   layout "centered"
-  # GET /resource/password/new
-  # def new
-  #   super
-  # end
 
-  # POST /resource/password
-  # def create
-  #   super
-  # end
+  def create
+    self.resource = resource_class.send_reset_password_instructions(resource_params)
+    set_flash_message! :notice, :send_paranoid_instructions
+    resource.email = nil
+    redirect_back(fallback_location: new_password_path(resource_name))
+  end
 
-  # GET /resource/password/edit?reset_password_token=abcdef
-  # def edit
-  #   super
-  # end
-
-  # PUT /resource/password
-  # def update
-  #   super
-  # end
-
-  # protected
-
-  # def after_resetting_password_path_for(resource)
-  #   super(resource)
-  # end
-
-  # The path used after sending reset password instructions
-  # def after_sending_reset_password_instructions_path_for(resource_name)
-  #   super(resource_name)
-  # end
+  def edit
+    @is_invitation = params[:is_invitation] == "1"
+    self.resource = resource_class.new
+    set_minimum_password_length
+    resource.reset_password_token = params[:reset_password_token]
+  end
 end
diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb
index c266662e..0ddd28c2 100644
--- a/app/controllers/users/registrations_controller.rb
+++ b/app/controllers/users/registrations_controller.rb
@@ -1,63 +1,11 @@
 # frozen_string_literal: true
 
 class Users::RegistrationsController < Devise::RegistrationsController
-  layout "centered"
-  # before_action :configure_sign_up_params, only: [:create]
-  # before_action :configure_account_update_params, only: [:update]
+  def new
+    redirect_to root_path
+  end
 
-  # GET /resource/sign_up
-  # def new
-  #   super
-  # end
-
-  # POST /resource
-  # def create
-  #   super
-  # end
-
-  # GET /resource/edit
-  # def edit
-  #   super
-  # end
-
-  # PUT /resource
-  # def update
-  #   super
-  # end
-
-  # DELETE /resource
-  # def destroy
-  #   super
-  # end
-
-  # GET /resource/cancel
-  # Forces the session data which is usually expired after sign
-  # in to be expired now. This is useful if the user wants to
-  # cancel oauth signing in/up in the middle of the process,
-  # removing all OAuth session data.
-  # def cancel
-  #   super
-  # end
-
-  # protected
-
-  # If you have extra params to permit, append them to the sanitizer.
-  # def configure_sign_up_params
-  #   devise_parameter_sanitizer.permit(:sign_up, keys: [:attribute])
-  # end
-
-  # If you have extra params to permit, append them to the sanitizer.
-  # def configure_account_update_params
-  #   devise_parameter_sanitizer.permit(:account_update, keys: [:attribute])
-  # end
-
-  # The path used after sign up.
-  # def after_sign_up_path_for(resource)
-  #   super(resource)
-  # end
-
-  # The path used after sign up for inactive accounts.
-  # def after_inactive_sign_up_path_for(resource)
-  #   super(resource)
-  # end
+  def create
+    redirect_to root_path
+  end
 end
diff --git a/app/javascript/controllers/modal_controller.js b/app/javascript/controllers/modal_controller.js
index 8304a8d3..37554b8f 100644
--- a/app/javascript/controllers/modal_controller.js
+++ b/app/javascript/controllers/modal_controller.js
@@ -5,7 +5,9 @@ export default class extends Controller {
 
   connect() {
     super.connect();
-    this.wrapperTarget.addEventListener('close', this.onModalClose.bind(this))
+    if (this.hasWrapperTarget) {
+      this.wrapperTarget.addEventListener('close', this.onModalClose.bind(this))
+    }
   }
 
   submitAndClose(event) {
diff --git a/app/mailers/application_mailer.rb b/app/mailers/application_mailer.rb
index 3c34c814..710b5421 100644
--- a/app/mailers/application_mailer.rb
+++ b/app/mailers/application_mailer.rb
@@ -1,4 +1,11 @@
-class ApplicationMailer < ActionMailer::Base
-  default from: "from@example.com"
+class ApplicationMailer < Devise::Mailer
+  default from: "Code for America <admin@demo.codeforamerica.ai>"
+
   layout "mailer"
+
+  def new_account_instructions(record, token)
+    @token = token
+    @resource = record
+    mail(to: @resource.email, subject: "Welcome! Set up your account", template_path: "users/mailer")
+  end
 end
diff --git a/app/models/document.rb b/app/models/document.rb
index a31d6801..767a5cb9 100644
--- a/app/models/document.rb
+++ b/app/models/document.rb
@@ -230,7 +230,7 @@ def inference_summary!
         api_host = "https://demo.codeforamerica.ai"
       end
       payload = {
-        model_name: "gemini-1.5-pro-latest",
+        model_name: "gemini-2.0-flash",
         documents: [{id: id, title: file_name, url: normalized_url, purpose: document_category}],
         page_limit: 7,
         inference_type: "summary",
diff --git a/app/models/user.rb b/app/models/user.rb
index 29f06430..71865233 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,14 +1,15 @@
 class User < ApplicationRecord
-  # Include default devise modules. Others available are:
-  # :confirmable, :lockable, :timeoutable, :trackable and :omniauthable
   devise :database_authenticatable, :registerable,
-    :recoverable, :rememberable, :validatable
+    :recoverable, :rememberable, :validatable, :trackable
 
-  # has_many :sessions, dependent: :destroy
   belongs_to :site, optional: true
   delegate :documents, to: :site, allow_nil: true
 
-  # normalizes :email_address, with: ->(e) { e.strip.downcase }
+  def send_new_account_instructions?
+    return false unless is_invited?
 
-  # validates :email_address, presence: true, uniqueness: {case_sensitive: false}, format: {with: URI::MailTo::EMAIL_REGEXP}
+    token = set_reset_password_token
+    ApplicationMailer.new_account_instructions(self, token).deliver_now
+    true
+  end
 end
diff --git a/app/views/admin/users/edit.html.erb b/app/views/admin/users/edit.html.erb
new file mode 100644
index 00000000..c984430f
--- /dev/null
+++ b/app/views/admin/users/edit.html.erb
@@ -0,0 +1,82 @@
+<div class="card ml-4 mr-4 lg:w-1/3 lg:mr-auto lg:ml-auto bg-gray-50 shadow-xl mt-12">
+  <div class="card-body">
+    <h1 class="text-lg font-medium">Edit <%= @user.email %></h1>
+
+    <%= form_with(model: [:admin, @user]) do |f| %>
+
+      <div class="form-control w-full mt-4">
+        <%= f.label :email, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full" + (@user.errors[:email].any? ? " input-error " : " border-black ") %>
+        <% if @user.errors[:email].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= @user.errors.full_message(:email, @user.errors[:email].first) %>
+          </div>
+        <% end %>
+      </div>
+
+      <% if @user.id == current_user.id %>
+        <div class="form-control w-full mt-4">
+          <%= f.label :current_password, class: "label-text text-black mb-2 font-semibold" %>
+          <%= f.password_field :current_password, autocomplete: "current-password", class: "input input-bordered w-full" + (@user.errors[:current_password].any? ? " input-error " : " border-black ") %>
+          <span class="label-text text-black mt-2">We need your current password to confirm any <b>password changes</b>.</span>
+          <% if @user.errors[:current_password].any? %>
+            <div class="field-error label-text mt-2 text-red-700">
+              <%= @user.errors.full_message(:current_password, @user.errors[:current_password].first) %>
+            </div>
+          <% end %>
+        </div>
+      <% end %>
+
+      <div class="form-control w-full mt-4">
+        <%= f.label :password, "New password", class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password].any? ? " input-error " : " border-black ") %>
+        <% if @minimum_password_length %>
+          <span class="label-text text-black mt-2">
+            <% if @minimum_password_length %><%= @minimum_password_length %> characters minimum.<% end %> Leave blank if you don't want to change it.</span>
+        <% end %>
+        <% if @user.errors[:password].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= @user.errors.full_message(:password, @user.errors[:password].first) %>
+          </div>
+        <% end %>
+      </div>
+
+      <div class="form-control w-full mt-4">
+        <%= f.label :password_confirmation, "New password confirmation", class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password_confirmation].any? ? " input-error " : " border-black ") %>
+        <% if @user.errors[:password_confirmation].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= @user.errors.full_message(:password_confirmation, @user.errors[:password_confirmation].first) %>
+          </div>
+        <% end %>
+      </div>
+
+      <div class="w-full mt-4">
+        <%= f.check_box :is_site_admin %>
+        <%= f.label :is_site_admin, class: "label-text text-black mb-2 font-semibold" %>
+        <div class="label-text text-black mt-2">User should be able to see and edit all sites and documents.</div>
+      </div>
+
+      <div class="w-full mt-4">
+        <%= f.check_box :is_user_admin %>
+        <%= f.label :is_user_admin, class: "label-text text-black mb-2 font-semibold" %>
+        <div class="label-text text-black mt-2">User should be able to edit other users and create admins.</div>
+      </div>
+
+      <div class="w-full mt-4">
+        <%= f.label :site_id, "Site", class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.select :site_id, grouped_options_for_select(@sites, @user.site_id),
+                     { include_blank: "None" },
+                     { class: "input input-bordered w-full select border-black" } %>
+      </div>
+
+      <div class="actions flex gap-4 items-center mt-6">
+        <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-user-form" do %>
+          <i class="fas fa-check mr-2"></i>
+          Update
+        <% end %>
+        <%= link_to "Back", :back %>
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/app/views/admin/users/index.html.erb b/app/views/admin/users/index.html.erb
new file mode 100644
index 00000000..7cadcf62
--- /dev/null
+++ b/app/views/admin/users/index.html.erb
@@ -0,0 +1,41 @@
+<div class="py-6">
+  <div class="mx-auto px-6 lg:px-8">
+    <div id="user-list" class="px-0 space-y-0 md:overflow-x-scroll">
+      <div class="bg-gray-50 shadow-sm rounded-t-lg px-6 py-4  border-b-gray-200 border-b">
+        <div class="flex justify-between items-center">
+          <h1 class="text-lg font-medium">Manage Users</h1>
+          <a href="<%= new_admin_user_path(@user) %>"  class="btn btn-primary text-white">
+            <i class="fas fa-plus mr-2"></i>
+            Add User
+          </a>
+        </div>
+      </div>
+      <div class="bg-white shadow-sm rounded-b-lg overflow-x-scroll">
+        <table class="min-w-full divide-y divide-gray-200 table-zebra">
+          <thead>
+            <tr>
+              <th scope="col" class="tracking-wider text-left py-4 px-3">Email</th>
+              <th scope="col" class="tracking-wider text-left py-4 px-3">Site</th>
+              <th scope="col" class="tracking-wider text-left py-4 px-3">Site Admin</th>
+              <th scope="col" class="tracking-wider text-left py-4 px-3">User Admin</th>
+              <th scope="col" class="tracking-wider text-left py-4 px-3">Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            <% @users.each do |user| %>
+              <tr>
+                <td class="tracking-wider text-left text-sm py-4 px-3"><%= user.email %></td>
+                <td class="tracking-wider text-left text-sm py-4 px-3"><%= user.site.present? ? user.site.name : "None" %></td>
+                <td class="tracking-wider text-left text-sm py-4 px-3"><%= user.is_site_admin? ? "Yes" : "No" %></td>
+                <td class="tracking-wider text-left text-sm py-4 px-3"><%= user.is_user_admin? ? "Yes" : "No" %></td>
+                <td class="tracking-wider text-left text-sm py-4 px-3">
+                  <%= link_to "Edit", edit_admin_user_path(user), class: "text-primary" %>
+                </td>
+              </tr>
+            <% end %>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/admin/users/new.html.erb b/app/views/admin/users/new.html.erb
new file mode 100644
index 00000000..cef07771
--- /dev/null
+++ b/app/views/admin/users/new.html.erb
@@ -0,0 +1,71 @@
+<div class="card ml-4 mr-4 lg:w-1/3 lg:mr-auto lg:ml-auto bg-gray-50 shadow-xl mt-12">
+  <div class="card-body">
+    <h1 class="text-lg font-medium">Add New User</h1>
+
+    <%= form_for(@user, url: admin_users_path) do |f| %>
+      <div class="form-control w-full mt-4">
+        <%= f.label :email, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full" + (@user.errors[:email].any? ? " input-error " : " border-black ")  %>
+        <% if @user.errors[:email].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= @user.errors.full_message(:email, @user.errors[:email].first)%>
+          </div>
+        <% end %>
+      </div>
+      <div class="w-full mt-4">
+        <%= f.check_box :is_invited %>
+        <%= f.label :is_invited, "Send invitation email", class: "label-text text-black mb-2 font-semibold" %>
+        <div class="label-text text-black mt-2">Send the user an invitation email, which includes a link to set password (skip password fields below).</div>
+      </div>
+      <div class="form-control w-full mt-4">
+        <%= f.label :password, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password].any? ? " input-error " : " border-black ")  %>
+        <% if @minimum_password_length %>
+          <span class="label-text text-black mt-2"><%= @minimum_password_length %> characters minimum.</span>
+        <% end %>
+        <% if @user.errors[:password].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= @user.errors.full_message(:password, @user.errors[:password].first)%>
+          </div>
+        <% end %>
+      </div>
+
+      <div class="form-control w-full mt-4">
+        <%= f.label :password_confirmation, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (@user.errors[:password_confirmation].any? ? " input-error " : " border-black ")  %>
+        <% if @user.errors[:password_confirmation].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= @user.errors.full_message(:password_confirmation, @user.errors[:password_confirmation].first)%>
+          </div>
+        <% end %>
+      </div>
+
+      <div class="w-full mt-4">
+        <%= f.check_box :is_site_admin %>
+        <%= f.label :is_site_admin, class: "label-text text-black mb-2 font-semibold" %>
+        <div class="label-text text-black mt-2">User should be able to see and edit all sites and documents.</div>
+      </div>
+
+      <div class="w-full mt-4">
+        <%= f.check_box :is_user_admin %>
+        <%= f.label :is_user_admin, class: "label-text text-black mb-2 font-semibold" %>
+        <div class="label-text text-black mt-2">User should be able to edit other users and create admins.</div>
+      </div>
+
+      <div class="w-full mt-4">
+        <%= f.label :site_id, "Site", class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.select :site_id, grouped_options_for_select(@sites, @user.site_id),
+                     { include_blank: "None" },
+                     { class: "input input-bordered w-full select border-black" } %>
+      </div>
+
+      <div class="actions flex gap-4 items-center mt-6">
+        <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-user-form" do %>
+          <i class="fas fa-check mr-2"></i>
+          Save
+        <% end %>
+        <%= link_to "Back", :back %>
+      </div>
+    <% end %>
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 1d01d144..8347acec 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -36,14 +36,22 @@
         </button>
         <div data-dropdown-target="menu" class="hidden absolute right-0 mt-2 w-48 rounded-md shadow-lg bg-white ring-1 ring-black ring-opacity-5 z-50">
           <div class="py-1">
+            <%= link_to edit_user_registration_path, class: "block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100" do %>
+              <i class="fas fa-person mr-2"></i>My Account
+            <% end %>
             <%= link_to sites_path, class: "block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100" do %>
               <i class="fas fa-globe mr-2"></i>My Sites
             <% end %>
-            <% if current_user.present? && current_user.is_admin? %>
+            <% if current_user.present? && current_user.is_site_admin? %>
               <%= link_to edit_configuration_path, class: "block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100" do %>
                 <i class="fas fa-wand-magic-sparkles mr-2"></i>AI Settings
               <% end %>
             <% end %>
+            <% if current_user.present? && current_user.is_user_admin? %>
+              <%= link_to admin_users_path, class: "block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100" do %>
+                <i class="fas fa-users mr-2"></i>Admin Users
+              <% end %>
+            <% end %>
             <%= button_to destroy_user_session_path, method: :delete, class: "w-full text-left px-4 py-2 text-sm text-gray-700 hover:bg-gray-100" do %>
               <i class="fas fa-sign-out-alt mr-2"></i>Logout
             <% end %>
@@ -77,7 +85,7 @@
   <% end %>
 </div>
 <!-- Main Content -->
-<main class="mt-6">
+<main class="mt-6 pb-6">
   <%= yield %>
 </main>
 </body>
diff --git a/app/views/layouts/mailer.html.erb b/app/views/layouts/mailer.html.erb
index 3aac9002..d1ba3f75 100644
--- a/app/views/layouts/mailer.html.erb
+++ b/app/views/layouts/mailer.html.erb
@@ -1,13 +1,71 @@
 <!DOCTYPE html>
-<html>
+<html lang="en">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
     <style>
-      /* Email styles need to be inline */
+        body {
+            font-family: Arial, sans-serif;
+            margin: 0;
+        }
+
+        #wrapper {
+            background-color: #d6d6d6;
+            padding: 20px;
+        }
+
+        #wrapper-inner {
+            background-color: #FFFFFF;
+            padding: 32px;
+            margin: 0 auto;
+            max-width: 600px;
+            border: 1px solid #e5e5e5;
+            border-radius: 5px;
+        }
+
+        #header {
+            width: 100%;
+            margin-bottom: 32px;
+            text-align: center;
+        }
+
+        #header img {
+            width: 120px;
+            display: block;
+            margin: 0 auto;
+        }
+
+        h1 {
+            font-size: 18px;
+            font-weight: normal;
+            margin: 16px 0 0 0;
+        }
+
+        #message-body {
+            font-size: 14px;
+            line-height: 1.5;
+        }
+
+        a {
+            color: #7f1125 !important;
+            text-decoration: none;
+        }
+
+        p {
+            margin: 0 0 16px 0;
+        }
     </style>
   </head>
-
   <body>
-    <%= yield %>
+    <div id="wrapper">
+      <div id="wrapper-inner">
+        <div id="header">
+          <img src="https://demo.codeforamerica.ai/assets/logo-81b734de.png" alt="The Code for America Logo"/>
+          <h1>Website PDF Accessibility Checker</h1>
+        </div>
+        <div id="message-body">
+          <%= yield %>
+        </div>
+      </div>
+    </div>
   </body>
 </html>
diff --git a/app/views/sites/index.html.erb b/app/views/sites/index.html.erb
index f6d03ea0..90179239 100644
--- a/app/views/sites/index.html.erb
+++ b/app/views/sites/index.html.erb
@@ -3,7 +3,7 @@
     <div class="px-4 sm:px-6 lg:px-8">
       <div class="flex justify-between items-center">
         <h1 class="text-gray-600">My Sites</h1>
-        <% if current_user.is_admin? %>
+        <% if current_user.is_site_admin? %>
           <button id="add-site-modal" onclick="add_site_modal.showModal()" class="btn btn-primary">Add Site</button>
         <% end %>
       </div>
@@ -44,7 +44,7 @@
     </div>
   </div>
 </div>
-<% if current_user.is_admin? %>
+<% if current_user.is_site_admin? %>
   <!-- Add Site Modal -->
   <dialog id="add_site_modal" class="modal" data-controller="modal">
     <div class="modal-box">
diff --git a/app/views/users/mailer/new_account_instructions.html.erb b/app/views/users/mailer/new_account_instructions.html.erb
new file mode 100644
index 00000000..5cccc669
--- /dev/null
+++ b/app/views/users/mailer/new_account_instructions.html.erb
@@ -0,0 +1,7 @@
+<p>Hello!</p>
+
+<p>Your account has been created, but requires activation. Please follow the link below to set a new password and log in.</p>
+
+<p><%= link_to 'Set my password', edit_password_url(@resource, reset_password_token: @token, is_invitation: 1) %></p>
+
+<p>If you didn't request this, please ignore this email.</p>
diff --git a/app/views/users/mailer/reset_password_instructions.html.erb b/app/views/users/mailer/reset_password_instructions.html.erb
index f667dc12..efce8d03 100644
--- a/app/views/users/mailer/reset_password_instructions.html.erb
+++ b/app/views/users/mailer/reset_password_instructions.html.erb
@@ -1,4 +1,4 @@
-<p>Hello <%= @resource.email %>!</p>
+<p>Hello!</p>
 
 <p>Someone has requested a link to change your password. You can do this through the link below.</p>
 
diff --git a/app/views/users/passwords/edit.html.erb b/app/views/users/passwords/edit.html.erb
index 863ffbb2..e32b1760 100644
--- a/app/views/users/passwords/edit.html.erb
+++ b/app/views/users/passwords/edit.html.erb
@@ -1,25 +1,45 @@
-<h2>Change your password</h2>
+<div class="card w-96 bg-base-100 shadow-xl">
+  <div class="card-body">
+    <h1 class="text-lg"><%= @is_invitation ? "Set" : "Change" %> your password</h1>
+    <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put }) do |f| %>
+      <%= f.hidden_field :reset_password_token %>
+      <% if resource.errors[:reset_password_token].any? %>
+        <div class="field-error label-text mt-2 text-red-700">
+          Reset password token has expired,
+          please <%= link_to "request a new one", new_password_path(resource_name), class: "text-black" %>
+        </div>
+      <% end %>
+      <div class="form-control w-full mt-4">
+        <%= f.label :password, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password].any? ? " input-error " : " border-black ") %>
+        <% if @minimum_password_length %>
+          <span class="label-text text-black mt-2">
+            <% if @minimum_password_length %><%= @minimum_password_length %> characters minimum.
+            <% end %> Leave blank if you don't want to change it.</span>
+        <% end %>
+        <% if resource.errors[:password].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= resource.errors.full_message(:password, resource.errors[:password].first) %>
+          </div>
+        <% end %>
+      </div>
 
-<%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put }) do |f| %>
-  <%= render "users/shared/error_messages", resource: resource %>
-  <%= f.hidden_field :reset_password_token %>
+      <div class="form-control w-full mt-4">
+        <%= f.label :password_confirmation, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password_confirmation].any? ? " input-error " : " border-black ") %>
+        <% if resource.errors[:password_confirmation].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= resource.errors.full_message(:password_confirmation, resource.errors[:password_confirmation].first) %>
+          </div>
+        <% end %>
+      </div>
 
-  <div class="field">
-    <%= f.label :password, "New password" %><br />
-    <% if @minimum_password_length %>
-      <em>(<%= @minimum_password_length %> characters minimum)</em><br />
+      <div class="actions mt-6">
+        <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-session-form" do %>
+          <i class="fas fa-sign-in-alt mr-2"></i>
+          <%= @is_invitation ? "Set" : "Change"%> my password
+        <% end %>
+      </div>
     <% end %>
-    <%= f.password_field :password, autofocus: true, autocomplete: "new-password" %>
   </div>
-
-  <div class="field">
-    <%= f.label :password_confirmation, "Confirm new password" %><br />
-    <%= f.password_field :password_confirmation, autocomplete: "new-password" %>
-  </div>
-
-  <div class="actions">
-    <%= f.submit "Change my password" %>
-  </div>
-<% end %>
-
-<%= render "users/shared/links" %>
+</div>
\ No newline at end of file
diff --git a/app/views/users/passwords/new.html.erb b/app/views/users/passwords/new.html.erb
index 3b30b06d..1dccc415 100644
--- a/app/views/users/passwords/new.html.erb
+++ b/app/views/users/passwords/new.html.erb
@@ -1,16 +1,26 @@
-<h2>Forgot your password?</h2>
+<div class="card w-96 bg-base-100 shadow-xl">
+  <div class="card-body">
+    <h1 class="text-lg">Forgot your password?</h1>
+    <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post }) do |f| %>
+      <div class="form-control w-full">
+        <%= f.label :email, class: "label label-text text-black font-semibold" %>
+        <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full " + (resource.errors[:base].any? ? " input-error " : " border-black ") %>
+        <% if resource.errors[:base].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= resource.errors.full_messages.first %>
+          </div>
+        <% end %>
+      </div>
 
-<%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post }) do |f| %>
-  <%= render "users/shared/error_messages", resource: resource %>
-
-  <div class="field">
-    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
-  </div>
-
-  <div class="actions">
-    <%= f.submit "Send me reset password instructions" %>
+      <div class="actions mt-6">
+        <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-session-form" do %>
+          <i class="fas fa-sign-in-alt mr-2"></i>
+          Send instructions
+        <% end %>
+      </div>
+      <div class="mt-6">
+        <%= link_to "Back to log in", session_path(resource_name), class: "text-primary"  %>
+      </div>
+    <% end %>
   </div>
-<% end %>
-
-<%= render "users/shared/links" %>
+</div>
\ No newline at end of file
diff --git a/app/views/users/registrations/edit.html.erb b/app/views/users/registrations/edit.html.erb
index 54a7c4a9..2fb29b28 100644
--- a/app/views/users/registrations/edit.html.erb
+++ b/app/views/users/registrations/edit.html.erb
@@ -1,43 +1,67 @@
-<h2>Edit <%= resource_name.to_s.humanize %></h2>
+<div class="card ml-4 mr-4 lg:w-1/3 lg:mr-auto lg:ml-auto bg-gray-50 shadow-xl mt-12">
+  <div class="card-body">
+    <h1 class="text-lg font-medium">Edit <%= resource_name.to_s.humanize %></h1>
 
-<%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %>
-  <%= render "users/shared/error_messages", resource: resource %>
+    <%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %>
 
-  <div class="field">
-    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
-  </div>
+      <div class="form-control w-full mt-4">
+        <%= f.label :email, class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full" + (resource.errors[:email].any? ? " input-error " : " border-black ") %>
+        <% if resource.errors[:email].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= resource.errors.full_message(:email, resource.errors[:email].first) %>
+          </div>
+        <% end %>
+      </div>
 
-  <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %>
-    <div>Currently waiting confirmation for: <%= resource.unconfirmed_email %></div>
-  <% end %>
+      <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %>
+        <div class="label-text text-black mt-2">Currently waiting confirmation for: <%= resource.unconfirmed_email %></div>
+      <% end %>
 
-  <div class="field">
-    <%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
-    <%= f.password_field :password, autocomplete: "new-password" %>
-    <% if @minimum_password_length %>
-      <br />
-      <em><%= @minimum_password_length %> characters minimum</em>
-    <% end %>
-  </div>
+      <% if resource.id == current_user.id %>
+        <div class="form-control w-full mt-4">
+          <%= f.label :current_password, class: "label-text text-black mb-2 font-semibold" %>
+          <%= f.password_field :current_password, autocomplete: "current-password", class: "input input-bordered w-full" + (resource.errors[:current_password].any? ? " input-error " : " border-black ") %>
+          <span class="label-text text-black mt-2">We need your current password to confirm any <b>password changes</b>.</span>
+          <% if resource.errors[:current_password].any? %>
+            <div class="field-error label-text mt-2 text-red-700">
+              <%= resource.errors.full_message(:current_password, resource.errors[:current_password].first) %>
+            </div>
+          <% end %>
+        </div>
+      <% end %>
 
-  <div class="field">
-    <%= f.label :password_confirmation %><br />
-    <%= f.password_field :password_confirmation, autocomplete: "new-password" %>
-  </div>
+      <div class="form-control w-full mt-4">
+        <%= f.label :password, "New password", class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password].any? ? " input-error " : " border-black ") %>
+        <% if @minimum_password_length %>
+          <span class="label-text text-black mt-2">
+            <% if @minimum_password_length %><%= @minimum_password_length %> characters minimum.<% end %> Leave blank if you don't want to change it.</span>
+        <% end %>
+        <% if resource.errors[:password].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= resource.errors.full_message(:password, resource.errors[:password].first) %>
+          </div>
+        <% end %>
+      </div>
 
-  <div class="field">
-    <%= f.label :current_password %> <i>(we need your current password to confirm your changes)</i><br />
-    <%= f.password_field :current_password, autocomplete: "current-password" %>
-  </div>
+      <div class="form-control w-full mt-4">
+        <%= f.label :password_confirmation, "Confirm new password", class: "label-text text-black mb-2 font-semibold" %>
+        <%= f.password_field :password_confirmation, autocomplete: "new-password", class: "input input-bordered w-full" + (resource.errors[:password_confirmation].any? ? " input-error " : " border-black ") %>
+        <% if resource.errors[:password_confirmation].any? %>
+          <div class="field-error label-text mt-2 text-red-700">
+            <%= resource.errors.full_message(:password_confirmation, resource.errors[:password_confirmation].first) %>
+          </div>
+        <% end %>
+      </div>
 
-  <div class="actions">
-    <%= f.submit "Update" %>
+      <div class="actions flex gap-4 items-center mt-6">
+        <%= button_tag type: "submit", class: "btn btn-primary text-white", id: "submit-session-form" do %>
+          <i class="fas fa-check mr-2"></i>
+          Update
+        <% end %>
+        <%= link_to "Back", :back %>
+      </div>
+    <% end %>
   </div>
-<% end %>
-
-<h3>Cancel my account</h3>
-
-<div>Unhappy? <%= button_to "Cancel my account", registration_path(resource_name), data: { confirm: "Are you sure?", turbo_confirm: "Are you sure?" }, method: :delete %></div>
-
-<%= link_to "Back", :back %>
+</div>
diff --git a/app/views/users/sessions/new.html.erb b/app/views/users/sessions/new.html.erb
index bb6e1673..117f311d 100644
--- a/app/views/users/sessions/new.html.erb
+++ b/app/views/users/sessions/new.html.erb
@@ -8,7 +8,7 @@
     </div>
     <%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
       <div class="form-control w-full">
-        <%= f.label :email, class: "label label-text text-black" %>
+        <%= f.label :email, class: "label label-text text-black font-semibold" %>
         <%= f.email_field :email, autofocus: true, autocomplete: "email", class: "input input-bordered w-full " + (resource.errors[:base].any? ? " input-error " : " border-black ") %>
         <% if resource.errors[:base].any? %>
           <div class="field-error label-text mt-2 text-red-700">
@@ -18,7 +18,7 @@
       </div>
 
       <div class="form-control w-full mt-4">
-        <%= f.label :password, class: "label label-text text-black" %>
+        <%= f.label :password, class: "label label-text text-black font-semibold" %>
         <%= f.password_field :password, autocomplete: "current-password", class: "input input-bordered w-full "  + (resource.errors[:base].any? ? " input-error " : " border-black ") %>
         <% if resource.errors[:base].any? %>
           <div class="field-error label-text mt-2 text-red-700">
@@ -40,6 +40,11 @@
           Log in
         <% end %>
       </div>
-    <% end %>
+      <%- if devise_mapping.recoverable? && controller_name != 'passwords' && controller_name != 'registrations' %>
+        <div class="mt-6 hidden">
+          <%= link_to "Forgot your password?", new_password_path(resource_name), class: "text-primary" %>
+        </div>
+      <% end %>
+  <% end %>
   </div>
 </div>
\ No newline at end of file
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 4786618b..c78f36b8 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -27,7 +27,18 @@
 
   config.active_support.report_deprecations = false
 
-  config.action_mailer.default_url_options = {host: "example.com"}
+  config.action_mailer.delivery_method = :smtp
+  config.action_mailer.smtp_settings = {
+    address: ENV.fetch("SMTP_ENDPOINT"),
+    port: 587,
+    domain: "demo.codeforamerica.ai",
+    user_name: ENV.fetch("SMTP_USER"),
+    password: ENV.fetch("SMTP_PASSWORD"),
+    authentication: "plain"
+  }
+  config.action_mailer.perform_deliveries = true
+  config.action_mailer.raise_delivery_errors = false
+  config.action_mailer.default_url_options = {host: "demo.codeforamerica.ai"}
 
   config.i18n.fallbacks = true
   config.active_record.dump_schema_after_migration = false
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index 875cbb60..b3c6e248 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -24,10 +24,10 @@
   # Configure the e-mail address which will be shown in Devise::Mailer,
   # note that it will be overwritten if you use your own mailer class
   # with default "from" parameter.
-  config.mailer_sender = "please-change-me-at-config-initializers-devise@example.com"
+  config.mailer_sender = "admin@demo.codeforamerica.ai"
 
   # Configure the class responsible to send e-mails.
-  # config.mailer = 'Devise::Mailer'
+  config.mailer = "ApplicationMailer"
 
   # Configure the parent class responsible to send e-mails.
   # config.parent_mailer = 'ActionMailer::Base'
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 6c349ae5..2383d5dc 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1,31 +1,8 @@
-# Files in the config/locales directory are used for internationalization and
-# are automatically loaded by Rails. If you want to use locales other than
-# English, add the necessary files in this directory.
-#
-# To use the locales, use `I18n.t`:
-#
-#     I18n.t "hello"
-#
-# In views, this is aliased to just `t`:
-#
-#     <%= t("hello") %>
-#
-# To use a different locale, set it with `I18n.locale`:
-#
-#     I18n.locale = :es
-#
-# This would use the information in config/locales/es.yml.
-#
-# To learn more about the API, please read the Rails Internationalization guide
-# at https://guides.rubyonrails.org/i18n.html.
-#
-# Be aware that YAML interprets the following case-insensitive strings as
-# booleans: `true`, `false`, `on`, `off`, `yes`, `no`. Therefore, these strings
-# must be quoted to be interpreted as strings. For example:
-#
-#     en:
-#       "yes": yup
-#       enabled: "ON"
-
 en:
-  hello: "Hello world"
+  activerecord:
+    errors:
+      models:
+        user:
+          attributes:
+            password_confirmation:
+              confirmation: "must match \"New password\""
\ No newline at end of file
diff --git a/config/routes.rb b/config/routes.rb
index d414d9b2..37605b53 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -5,7 +5,9 @@
     registrations: "users/registrations"
   }
   # Administrative user paths.
-  resources :users, only: [:index, :new, :create, :edit, :update], controller: "users/admin"
+  namespace :admin do
+    resources :users, only: [:index, :new, :create, :edit, :update, :show]
+  end
 
   get "up" => "rails/health#show", :as => :rails_health_check
 
diff --git a/db/migrate/20250711141619_change_admin_roles.rb b/db/migrate/20250711141619_change_admin_roles.rb
new file mode 100644
index 00000000..1228bf8a
--- /dev/null
+++ b/db/migrate/20250711141619_change_admin_roles.rb
@@ -0,0 +1,8 @@
+class ChangeAdminRoles < ActiveRecord::Migration[8.0]
+  def change
+    change_table :user do |t|
+      rename_column :users, :is_admin, :is_site_admin
+      add_column :users, :is_user_admin, :boolean
+    end
+  end
+end
diff --git a/db/migrate/20250716155512_add_devise_trackable.rb b/db/migrate/20250716155512_add_devise_trackable.rb
new file mode 100644
index 00000000..58c92469
--- /dev/null
+++ b/db/migrate/20250716155512_add_devise_trackable.rb
@@ -0,0 +1,11 @@
+class AddDeviseTrackable < ActiveRecord::Migration[8.0]
+  def self.up
+    change_table :users do |t|
+      t.integer :sign_in_count, default: 0, null: false
+      t.datetime :current_sign_in_at
+      t.datetime :last_sign_in_at
+      t.string :current_sign_in_ip
+      t.string :last_sign_in_ip
+    end
+  end
+end
diff --git a/db/migrate/20250716163605_add_invitation_flag.rb b/db/migrate/20250716163605_add_invitation_flag.rb
new file mode 100644
index 00000000..5f06b44d
--- /dev/null
+++ b/db/migrate/20250716163605_add_invitation_flag.rb
@@ -0,0 +1,7 @@
+class AddInvitationFlag < ActiveRecord::Migration[8.0]
+  def change
+    change_table :users do |t|
+      t.boolean :is_invited
+    end
+  end
+end
diff --git a/docker-compose.yml b/docker-compose.yml
index b6af5838..438d54fa 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -38,6 +38,8 @@ services:
       - "9002:8080"
     environment:
       - ASAP_LOCAL_MODE=True
+    volumes:
+      - ./python_components/document_inference:/var/task
   lambda_evaluation:
     container_name: lambda_evaluation
     build:
diff --git a/lib/tasks/users.rake b/lib/tasks/users.rake
index caa3c001..e0f89e29 100644
--- a/lib/tasks/users.rake
+++ b/lib/tasks/users.rake
@@ -3,7 +3,8 @@ namespace :users do
   task :create_admin, [:password] => :environment do |t, args|
     User.find_or_create_by!(email: "admin@codeforamerica.org") do |user|
       user.password = args.password
-      user.is_admin = true
+      user.is_site_admin = true
+      user.is_user_admin = true
       puts "Created test user: admin@codeforamerica.org / #{args.password}"
     end
   end
diff --git a/python_components/ci/requirements.txt b/python_components/ci/requirements.txt
index 49bc2a8e..198e37d8 100644
--- a/python_components/ci/requirements.txt
+++ b/python_components/ci/requirements.txt
@@ -2,23 +2,25 @@ backports.tarfile==1.2.0
 beautifulsoup4==4.13.3
 black==25.1.0
 boto3==1.38.30
-deepeval @ git+https://github.com/codeforamerica/deepeval.git@fix/support-read-only-file-systems
+deepeval==3.1.4
 flake8==7.1.2
 google-api-python-client==2.171.0
 google-auth-oauthlib==1.2.2
-importlib-metadata==8.0.0
+inflect==7.3.1
 isort==6.0.1
+jaraco-functools==4.2.1
 jaraco.collections==5.1.0
-requests-aws4auth==1.3.1
+llm==0.26
 pandas==2.2.3
 pip-chill==1.0.3
-PyMuPDF==1.25.5
-pytest==8.3.5
-pydantic==2.11.5
+pymupdf==1.25.5
+pypdf==5.8.0
+pysocks==1.7.1
+pytest-httpserver==1.1.3
+requests-aws4auth==1.3.1
 scikit-learn==1.6.1
 selenium==4.34.2
 spacy==3.8.7
 tldextract==5.1.3
 tomli==2.0.1
-tqdm==4.67.1
-xgboost==2.1.4
+xgboost==2.1.4
\ No newline at end of file
diff --git a/python_components/ci/scripts/entrypoint.sh b/python_components/ci/scripts/entrypoint.sh
index 73624f00..f4ff6a3e 100755
--- a/python_components/ci/scripts/entrypoint.sh
+++ b/python_components/ci/scripts/entrypoint.sh
@@ -3,6 +3,7 @@ set -e
 
 # Install any local packages.
 pip install python_components/evaluation
+pip install python_components/document_inference
 
 # Execute the main command
 exec "$@"
\ No newline at end of file
diff --git a/python_components/document_inference/document_inference/helpers.py b/python_components/document_inference/document_inference/helpers.py
index 548e28b1..5fc15f02 100644
--- a/python_components/document_inference/document_inference/helpers.py
+++ b/python_components/document_inference/document_inference/helpers.py
@@ -1,7 +1,7 @@
 import json
 import logging
 import os
-import urllib
+import shutil
 
 import boto3
 import fitz
@@ -49,7 +49,19 @@ def get_secret(secret_name: str, local_mode: bool) -> str:
 def get_file(url: str, output_path: str) -> str:
     file_name = os.path.basename(url)
     local_path = f"{output_path}/{file_name}"
-    urllib.request.urlretrieve(url, local_path)
+    headers = {
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
+        "Accept": "application/pdf,application/octet-stream,*/*",
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate",
+        "DNT": "1",
+        "Connection": "keep-alive",
+        "Upgrade-Insecure-Requests": "1",
+    }
+    with requests.get(url, headers=headers, stream=True) as response:
+        response.raise_for_status()
+        with open(f"{output_path}/{file_name}", "wb") as file:
+            shutil.copyfileobj(response.raw, file)
     return local_path
 
 
diff --git a/python_components/document_inference/lambda_function.py b/python_components/document_inference/lambda_function.py
index 2affcfb0..ef097be3 100644
--- a/python_components/document_inference/lambda_function.py
+++ b/python_components/document_inference/lambda_function.py
@@ -76,4 +76,5 @@ def handler(event, context):
         else:
             return {"statusCode": 200, "body": helpers.json_dump_collection()}
     except Exception as e:
+        helpers.logger.error(f"Error during execution: {e}")
         return {"statusCode": 500, "body": str(e)}
diff --git a/python_components/document_inference/models.json b/python_components/document_inference/models.json
index a85480c5..2c2909f9 100644
--- a/python_components/document_inference/models.json
+++ b/python_components/document_inference/models.json
@@ -5,6 +5,12 @@
   "gemini-1.5-pro-latest": {
     "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003"
   },
+  "gemini-2.0-flash": {
+    "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003"
+  },
+  "gemini-2.0-flash-lite": {
+    "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003"
+  },
   "gemini-2.5-pro-preview-03-25": {
     "key": "/asap-pdf/production/GOOGLE_AI_KEY-20250521205655769000000003"
   }
diff --git a/python_components/document_inference/tests/test_file_downloads.py b/python_components/document_inference/tests/test_file_downloads.py
new file mode 100644
index 00000000..252830de
--- /dev/null
+++ b/python_components/document_inference/tests/test_file_downloads.py
@@ -0,0 +1,89 @@
+import os
+
+from document_inference.helpers import get_file
+from pytest_httpserver import HTTPServer
+from werkzeug import Request, Response
+
+"""
+Tests to assert that our file getting method works with some known curveballs.
+"""
+
+
+def test_default_behavior(httpserver: HTTPServer):
+    def handler(request: Request):
+        return Response("Plain pdf content!", 200)
+
+    httpserver.expect_request("/test.pdf").respond_with_handler(handler)
+    _remove_file_if_exists("/tmp/test.pdf")
+    get_file(httpserver.url_for("/test.pdf"), "/tmp")
+    _assert_file_contents("/tmp/test.pdf", "Plain pdf content!")
+
+
+def test_content_disposition(httpserver: HTTPServer):
+    def handler(request: Request):
+        return Response(
+            "Great pdf content!",
+            200,
+            headers={"Content-Disposition": "attachment", "filename": "mypdf.pdf"},
+        )
+
+    httpserver.expect_request("/test.pdf").respond_with_handler(handler)
+    _remove_file_if_exists("/tmp/test.pdf")
+    get_file(httpserver.url_for("/test.pdf"), "/tmp")
+    _assert_file_contents("/tmp/test.pdf", "Great pdf content!")
+
+
+def test_header_assertion(httpserver: HTTPServer):
+    def handler(request: Request):
+        try:
+            headers_as_text = str(request.headers)
+            assert (
+                "python" not in headers_as_text
+            ), f"Headers contain 'python': {headers_as_text}"
+            assert (
+                "urllib" not in headers_as_text
+            ), f"Headers contain 'urllib': {headers_as_text}"
+            assert (
+                "Mozilla" in headers_as_text
+            ), f"Headers missing 'Mozilla': {headers_as_text}"
+            return Response("Great pdf validated by headers content!", 200)
+        except AssertionError as e:
+            print(f"Assertion failed: {e}")
+            return Response(f"Assertion failed: {e}", 500)
+
+    httpserver.expect_request("/test.pdf").respond_with_handler(handler)
+    _remove_file_if_exists("/tmp/test.pdf")
+    get_file(httpserver.url_for("/test.pdf"), "/tmp")
+    _assert_file_contents("/tmp/test.pdf", "Great pdf validated by headers content!")
+
+
+def test_308_redirect(httpserver: HTTPServer):
+    def redirect_handler(request: Request):
+        return Response(
+            "",
+            status=308,
+            headers={
+                "Location": httpserver.url_for("/redirected.pdf"),
+                "Cache-Control": "max-age=3600",
+            },
+        )
+
+    def final_handler(request: Request):
+        return Response("Great redirected content!", 200)
+
+    httpserver.expect_request("/original.pdf").respond_with_handler(redirect_handler)
+    httpserver.expect_request("/redirected.pdf").respond_with_handler(final_handler)
+    _remove_file_if_exists("/tmp/original.pdf")
+    get_file(httpserver.url_for("/original.pdf"), "/tmp")
+    _assert_file_contents("/tmp/original.pdf", "Great redirected content!")
+
+
+def _remove_file_if_exists(path: str):
+    if os.path.exists(path):
+        os.remove(path)
+    assert not os.path.exists(path)
+
+
+def _assert_file_contents(path: str, contents: str):
+    with open(path, "r") as f:
+        assert f.read() == contents
diff --git a/python_components/evaluation/evaluation/utility/document.py b/python_components/evaluation/evaluation/utility/document.py
index cd4abb49..116795ae 100644
--- a/python_components/evaluation/evaluation/utility/document.py
+++ b/python_components/evaluation/evaluation/utility/document.py
@@ -1,6 +1,6 @@
 import datetime
 import os
-import urllib
+import shutil
 from abc import ABC, abstractmethod
 from pathlib import Path
 from typing import Any, List
@@ -8,6 +8,7 @@
 import boto3
 import fitz
 import pandas as pd
+import requests
 from deepeval.models import DeepEvalBaseMLLM
 from deepeval.test_case import MLLMImage
 from evaluation.utility.helpers import logger
@@ -81,7 +82,19 @@ def add_images_to_document(
 def get_file(url: str, output_path: str) -> str:
     file_name = os.path.basename(url)
     local_path = f"{output_path}/{file_name}"
-    urllib.request.urlretrieve(url, local_path)
+    headers = {
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
+        "Accept": "application/pdf,application/octet-stream,*/*",
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate",
+        "DNT": "1",
+        "Connection": "keep-alive",
+        "Upgrade-Insecure-Requests": "1",
+    }
+    with requests.get(url, headers=headers, stream=True) as response:
+        response.raise_for_status()
+        with open(f"{output_path}/{file_name}", "wb") as file:
+            shutil.copyfileobj(response.raw, file)
     return local_path
 
 
diff --git a/python_components/evaluation/lambda_function.py b/python_components/evaluation/lambda_function.py
index 7e0964cd..dcc791a2 100644
--- a/python_components/evaluation/lambda_function.py
+++ b/python_components/evaluation/lambda_function.py
@@ -107,4 +107,5 @@ def handler(event, context):
         output = str(e)
         if local_mode:
             output = traceback.format_exc()
+        utility.helpers.logger.error(f"Error during execution: {output}")
         return {"statusCode": 500, "body": output}
diff --git a/spec/factories/users.rb b/spec/factories/users.rb
index bebaab88..41370349 100644
--- a/spec/factories/users.rb
+++ b/spec/factories/users.rb
@@ -2,8 +2,8 @@
   factory :user do
     email { "user#{rand(1000)}@example.com" }
     password { "password" }
-    trait :admin do
-      is_admin { true }
+    trait :site_admin do
+      is_site_admin { true }
     end
   end
 end
diff --git a/spec/features/admin_spec.rb b/spec/features/admin_spec.rb
index 9cce7477..d77bc316 100644
--- a/spec/features/admin_spec.rb
+++ b/spec/features/admin_spec.rb
@@ -1,12 +1,13 @@
 require "rails_helper"
 
-describe "admins can see admin pages", type: :feature do
+describe "admins can see admin pages", js: true, type: :feature do
   before :each do
+    Site.create(location: "Colorado", name: "City and County of Denver", primary_url: "https://www.denver.gov")
     @current_user = User.create(email: "user@example.com", password: "password")
     login_user(@current_user)
   end
 
-  it "admins can create and see sites" do
+  it "admins can view AI configuration" do
     visit "/"
     within("#header") do
       user_menu = find("[data-action='click->dropdown#toggle']")
@@ -17,9 +18,9 @@
       expect(page).to have_no_content "AI Settings"
     end
     visit "/configuration/edit"
-    expect(current_path).to eq("/sites")
+    expect(page).to have_current_path("/sites")
     expect(page).to have_content "You don't have permission to access that page."
-    @current_user.is_admin = true
+    @current_user.is_site_admin = true
     @current_user.save
     visit "/"
     within("#header") do
@@ -27,7 +28,75 @@
       user_menu.click
       click_link("AI Settings")
     end
-    expect(current_path).to eq("/configuration/edit")
+    expect(page).to have_current_path("/configuration/edit")
     expect(page).to have_content "AI Configuration Settings"
   end
+
+  it "admins can view user admin pages" do
+    visit "/"
+    within("#header") do
+      user_menu = find("[data-action='click->dropdown#toggle']")
+      user_menu.click
+    end
+    within("div[data-dropdown-target='menu']") do
+      expect(page).to have_content "My Sites"
+      expect(page).to have_no_content "Admin Users"
+    end
+    visit "/admin/users"
+    expect(page).to have_current_path("/sites")
+    expect(page).to have_content "You don't have permission to access that page."
+    visit "/admin/users/new"
+    expect(current_path).to eq("/sites")
+    expect(page).to have_content "You don't have permission to access that page."
+    visit "/admin/users/1/edit"
+    expect(page).to have_current_path("/sites")
+    expect(page).to have_content "You don't have permission to access that page."
+    @current_user.is_user_admin = true
+    @current_user.save
+    visit "/admin/users"
+    expect(page).to have_content "Manage Users"
+    expect(page).to have_content "user@example.com None No Yes Edit"
+    within("#user-list") do
+      click_link "Add User"
+    end
+    expect(page).to have_current_path("/admin/users/new")
+    fill_in "Email", with: "user@example.com"
+    fill_in "Password", with: "123459!"
+    fill_in "Password confirmation", with: "123459!"
+    click_button "Save"
+    expect(page).to have_current_path("/admin/users/new")
+    expect(page).to have_content "Email has already been taken"
+    fill_in "Email", with: "bob@example.com"
+    fill_in "Password", with: "123459!"
+    fill_in "Password confirmation", with: "123459!"
+    check "Is user admin"
+    select "City and County of Denver", from: "Site"
+    click_button "Save"
+    expect(page).to have_current_path("/admin/users")
+    expect(page).to have_content "bob@example.com City and County of Denver No Yes Edit"
+    within("#user-list tr:nth-child(2)") do
+      click_link("Edit")
+    end
+    expect(page).to have_content("Edit bob@example.com")
+    select "None", from: "Site"
+    check "Is site admin"
+    click_button "Update"
+    expect(page).to have_current_path("/admin/users")
+    expect(page).to have_content "bob@example.com None Yes Yes Edit"
+  end
+
+  it "admins can invite users" do
+    clear_emails
+    @current_user.is_user_admin = true
+    @current_user.save
+    visit "/admin/users/new"
+    fill_in "Email", with: "test-invite@example.com"
+    check "Send invitation email"
+    click_button "Save"
+    expect(page).to have_content "User added successfully. Instructions were emailed to the user."
+    expect(page).to have_current_path "/admin/users"
+    wait_for_mail_delivery
+    open_email("test-invite@example.com")
+    expect(current_email).to have_content "Your account has been created, but requires activation. Please follow the link below to set a new password and log in."
+  end
 end
diff --git a/spec/features/login_spec.rb b/spec/features/login_spec.rb
index 2d600259..07215b0f 100644
--- a/spec/features/login_spec.rb
+++ b/spec/features/login_spec.rb
@@ -28,4 +28,19 @@
     expect(page).to have_content "Signed in successfully"
     expect(page).to have_no_selector "#new_user"
   end
+  # clear_emails
+  # it "password resets" do
+  #   clear_emails
+  #   visit "/users/sign_in"
+  #   click_link "Forgot your password?"
+  #   expect(page).to have_current_path "/users/password/new", wait: 5
+  #   expect(page).to have_content "Forgot your password?"
+  #   fill_in "Email", with: "bob@example.com"
+  #   click_button "Send instructions"
+  #   expect(page).to have_content "If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes."
+  #   expect(ActionMailer::Base.deliveries).to be_empty
+  #   fill_in "Email", with: "bob@example.com"
+  #   click_button "Send instructions"
+  #   expect(page).to have_content "If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes."
+  # end
 end
diff --git a/spec/features/site_spec.rb b/spec/features/site_spec.rb
index f9f52d38..423ec689 100644
--- a/spec/features/site_spec.rb
+++ b/spec/features/site_spec.rb
@@ -9,7 +9,7 @@
   it "admins can create and see sites" do
     visit "/"
     expect(page).to have_no_content("Add New Site")
-    @current_user.is_admin = true
+    @current_user.is_site_admin = true
     @current_user.save
     visit "/"
     click_button "Add Site", id: "add-site-modal"
diff --git a/spec/helpers/mail.rb b/spec/helpers/mail.rb
new file mode 100644
index 00000000..e15f32da
--- /dev/null
+++ b/spec/helpers/mail.rb
@@ -0,0 +1,14 @@
+module MailHelpers
+  def wait_for_mail_delivery
+    Timeout.timeout(5) do
+      loop do
+        break if ActionMailer::Base.deliveries.any?
+        sleep(0.1)
+      end
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.include MailHelpers, type: :feature
+end
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index 02169cb1..d1447214 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -8,6 +8,7 @@
 require "shoulda/matchers"
 require "capybara/rails"
 require "helpers/user"
+require "helpers/mail"
 
 # Capybara.default_driver = :selenium_chrome
 
diff --git a/spec/requests/api/sites_spec.rb b/spec/requests/api/sites_spec.rb
index 0d53a280..06e6deb8 100644
--- a/spec/requests/api/sites_spec.rb
+++ b/spec/requests/api/sites_spec.rb
@@ -13,7 +13,7 @@ def auth_headers
     {"HTTP_AUTHORIZATION" => encoded_credentials}
   end
 
-  let!(:user) { create(:user, :admin) }
+  let!(:user) { create(:user, :site_admin) }
 
   describe "GET /sites" do
     let!(:sites) { create_list(:site, 3) }
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 0c3ad0be..fd5c56d8 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -1,6 +1,7 @@
 require "shoulda/matchers"
 require "factory_bot_rails"
 require "capybara/rspec"
+require "capybara/email/rspec"
 
 RSpec.configure do |config|
   config.expect_with :rspec do |expectations|
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
index a36f4ab2..603a4a8b 100644
--- a/terraform/.terraform.lock.hcl
+++ b/terraform/.terraform.lock.hcl
@@ -1,6 +1,28 @@
 # This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.
 
+provider "registry.opentofu.org/cloudposse/awsutils" {
+  version     = "0.20.1"
+  constraints = ">= 0.11.0"
+  hashes = [
+    "h1:6r2pii9sYLWC3UXHO7yu/ZPQFmfUltWT+o+Tr9jE3ns=",
+    "zh:13892dc53f9f6af7d13665a95c11e8821538ced3fdb04fbac92f5346a677bf81",
+    "zh:4659d0e4e59608b81f08dd989f2674dcd549610454a0f1ed4c245c5f367af164",
+    "zh:47d879ff6611a6e401f92d125b57ef14ab6c848792b0347204daef57cb9700bc",
+    "zh:5c41a0ed4f2996a2bd62a8352dcc828f4ac3b157d209c4d9a6c0fefe4181c0c0",
+    "zh:6ccdec55c0f7d87b8f674a71b79a333f13cf781034f7feecd26e6782e90a902a",
+    "zh:8263fcf0be891adb101157ba8054094109f436b3fe974bb2da8f99ed55d2d5d2",
+    "zh:89cf2450d3fba0ac3646f4b9a37803e179583860801ef21201845165073737f9",
+    "zh:9fcb8243ce3cf9d4cfb8602ed8b31081fd59eac8570838959817aed385a31ad7",
+    "zh:a9c0f440eb77c77b25c99c4e7faf27cfdc5e80cd52fc8318ffcbc47f0db90ee1",
+    "zh:d42a6bc5e5fafb076f7d79038908602acff5a6ec727da06e7cbabcadf3ad8bb9",
+    "zh:eb14a3071ecd35fa38d12b8a688f125aadf9ce61db0d91c0024f9a3788bd0a73",
+    "zh:eefbba6dc993b636e209b3a7f2dd98dc9242572a319c0580e8725987d07341b6",
+    "zh:f52b3b8e830032b3c16b93c683cd0c543ceed83f60be71bcbfcb293665d5a76d",
+    "zh:f584e27d2c922289008034774c1b0b45af3c90714c588b7f1c17a84cce723690",
+  ]
+}
+
 provider "registry.opentofu.org/hashicorp/aws" {
   version     = "5.100.0"
   constraints = ">= 3.29.0, >= 3.74.0, >= 4.15.1, >= 4.37.0, >= 5.0.0, ~> 5.0, >= 5.44.0, >= 5.79.0, >= 5.81.0, >= 5.83.0, >= 5.93.0, >= 5.99.0"
@@ -19,6 +41,42 @@ provider "registry.opentofu.org/hashicorp/aws" {
   ]
 }
 
+provider "registry.opentofu.org/hashicorp/local" {
+  version     = "2.5.3"
+  constraints = ">= 1.2.0"
+  hashes = [
+    "h1:31Clmfoe7hzkcdgwuhUuGuPGfeG2Ksk+YWcJgzBTN7M=",
+    "zh:32e1d4b0595cea6cda4ca256195c162772ddff25594ab4008731a2ec7be230bf",
+    "zh:48c390af0c87df994ec9796f04ec2582bcac581fb81ed6bb58e0671da1c17991",
+    "zh:4be7289c969218a57b40902e2f359914f8d35a7f97b439140cb711aa21e494bd",
+    "zh:4cf958e631e99ed6c8b522c9b22e1f1b568c0bdadb01dd002ca7dffb1c927764",
+    "zh:7a0132c0faca4c4c96aa70808effd6817e28712bf5a39881666ac377b4250acf",
+    "zh:7d60de08fac427fb045e4590d1b921b6778498eee9eb16f78c64d4c577bde096",
+    "zh:91003bee5981e99ec3925ce2f452a5f743827f9d0e131a86613549c1464796f0",
+    "zh:9fe2fe75977c8149e2515fb30c6cc6cfd57b225d4ce592c570d81a3831d7ffa3",
+    "zh:e210e6be54933ce93e03d0994e520ba289aa01b2c1f70e77afb8f2ee796b0fe3",
+    "zh:e8793e5f9422f2b31a804e51806595f335b827c9a38db18766960464566f21d5",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/null" {
+  version     = "3.2.4"
+  constraints = ">= 2.0.0"
+  hashes = [
+    "h1:i+WKhUHL2REY5EGmiHjfUljJB8UKZ9QdhdM5uTeUhC4=",
+    "zh:1769783386610bed8bb1e861a119fe25058be41895e3996d9216dd6bb8a7aee3",
+    "zh:32c62a9387ad0b861b5262b41c5e9ed6e940eda729c2a0e58100e6629af27ddb",
+    "zh:339bf8c2f9733fce068eb6d5612701144c752425cebeafab36563a16be460fb2",
+    "zh:36731f23343aee12a7e078067a98644c0126714c4fe9ac930eecb0f2361788c4",
+    "zh:3d106c7e32a929e2843f732625a582e562ff09120021e510a51a6f5d01175b8d",
+    "zh:74bcb3567708171ad83b234b92c9d63ab441ef882b770b0210c2b14fdbe3b1b6",
+    "zh:90b55bdbffa35df9204282251059e62c178b0ac7035958b93a647839643c0072",
+    "zh:ae24c0e5adc692b8f94cb23a000f91a316070fdc19418578dcf2134ff57cf447",
+    "zh:b5c10d4ad860c4c21273203d1de6d2f0286845edf1c64319fa2362df526b5f58",
+    "zh:e05bbd88e82e1d6234988c85db62fd66f11502645838fff594a2ec25352ecd80",
+  ]
+}
+
 provider "registry.opentofu.org/hashicorp/random" {
   version     = "3.7.2"
   constraints = ">= 3.0.0"
diff --git a/terraform/main.tf b/terraform/main.tf
index c9d323db..9676851f 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -47,12 +47,21 @@ module "secrets" {
         secret_key = ""
       })
     }
+    smtp = {
+      description = "The SMTP credentials."
+      name        = "/asap-pdf/production/smtp"
+      start_value = jsonencode({
+        endpoint = ""
+        user     = ""
+        password = ""
+      })
+    }
     google = {
-      description = "The Rails master key."
+      description = "Optional Google API key."
       name        = "/asap-pdf/production/GOOGLE_AI_KEY"
     }
     anthropic = {
-      description = "The Rails master key."
+      description = "Optional Anthropic API key."
       name        = "/asap-pdf/production/ANTHROPIC_KEY"
     }
     rails_api_user = {
@@ -139,7 +148,10 @@ module "ecs" {
   db_password_secret_arn      = "${module.secrets.secrets["database"].secret_arn}:password"
   secret_key_base_secret_arn  = "${module.secrets.secrets["rails"].secret_arn}:secret_key"
   rails_master_key_secret_arn = "${module.secrets.secrets["rails"].secret_arn}:master_key"
-  redis_url_secret_arn = "${module.secrets.secrets["redis"].secret_arn}:url"
+  smtp_endpoint_secret_arn    = "${module.secrets.secrets["smtp"].secret_arn}:ednpoint"
+  smtp_user_secret_arn        = "${module.secrets.secrets["smtp"].secret_arn}:user"
+  smtp_password_secret_arn    = "${module.secrets.secrets["smtp"].secret_arn}:password"
+  redis_url_secret_arn        = "${module.secrets.secrets["redis"].secret_arn}:url"
 
   vpc_id            = module.networking.vpc_id
   private_subnets   = module.networking.private_subnet_ids
@@ -169,6 +181,14 @@ module "lambda" {
   s3_document_bucket_arn                           = aws_s3_bucket.documents.arn
 }
 
+module "ses" {
+  source = "./modules/ses"
+
+  project_name = var.project_name
+  environment  = var.environment
+  domain_name  = var.domain_name
+}
+
 # S3 bucket for PDF storage
 resource "aws_s3_bucket" "documents" {
   bucket = "${var.project_name}-${var.environment}-documents"
diff --git a/terraform/modules/ecs/main.tf b/terraform/modules/ecs/main.tf
index f07a76f7..bac5463f 100644
--- a/terraform/modules/ecs/main.tf
+++ b/terraform/modules/ecs/main.tf
@@ -12,8 +12,8 @@ module "fargate_service" {
   private_subnets = var.private_subnets
   public_subnets  = var.public_subnets
   logging_key_id  = var.logging_key_id
-  cpu = 1024
-  memory = 2048
+  cpu             = 1024
+  memory          = 2048
   container_port  = 3000
 
   execution_policies = [aws_iam_policy.ecs_task_secrets_policy.arn, aws_iam_policy.ecs_s3_access.arn]
@@ -41,15 +41,16 @@ module "fargate_service" {
     DB_PASSWORD : var.db_password_secret_arn
     SECRET_KEY_BASE : var.secret_key_base_secret_arn
     RAILS_MASTER_KEY : var.rails_master_key_secret_arn
-    REDIS_URL : var.redis_url_secret_arn
+    REDIS_URL : var.redis_url_secret_arn,
+    SMTP_ENDPOINT : var.smtp_endpoint_secret_arn,
+    SMTP_USER : var.smtp_user_secret_arn,
+    SMTP_PASSWORD : var.smtp_password_secret_arn,
   }
 }
 
 # Add permissions for Secrets Manager access
 resource "aws_iam_policy" "ecs_task_secrets_policy" {
   name = "${var.project_name}-${var.environment}-task-secrets-policy"
-  # @todo Not sure how to get this.
-  #role = aws_iam_role.ecs_task_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -66,7 +67,10 @@ resource "aws_iam_policy" "ecs_task_secrets_policy" {
           var.db_password_secret_arn,
           var.secret_key_base_secret_arn,
           var.rails_master_key_secret_arn,
-          var.redis_url_secret_arn
+          var.redis_url_secret_arn,
+          var.smtp_endpoint_secret_arn,
+          var.smtp_user_secret_arn,
+          var.smtp_password_secret_arn,
         ]
       }
     ]
diff --git a/terraform/modules/ecs/variables.tf b/terraform/modules/ecs/variables.tf
index 8659f9bc..7f2d90c7 100644
--- a/terraform/modules/ecs/variables.tf
+++ b/terraform/modules/ecs/variables.tf
@@ -44,6 +44,21 @@ variable "rails_master_key_secret_arn" {
   type        = string
 }
 
+variable "smtp_endpoint_secret_arn" {
+  description = "ARN of the SMTP endpoint"
+  type        = string
+}
+
+variable "smtp_user_secret_arn" {
+  description = "ARN of the SMTP user name"
+  type        = string
+}
+
+variable "smtp_password_secret_arn" {
+  description = "ARN of the SMTP password"
+  type        = string
+}
+
 variable "redis_url_secret_arn" {
   description = "ARN of the Redis URL secret in Secrets Manager"
   type        = string
diff --git a/terraform/modules/ses/main.tf b/terraform/modules/ses/main.tf
new file mode 100644
index 00000000..92848162
--- /dev/null
+++ b/terraform/modules/ses/main.tf
@@ -0,0 +1,12 @@
+data "aws_route53_zone" "domain" {
+  name = var.domain_name
+}
+
+module "ses" {
+  name =  "${var.project_name}-${var.environment}-ses"
+  source = "github.com/cloudposse/terraform-aws-ses"
+  domain = var.domain_name
+  zone_id = data.aws_route53_zone.domain.id
+  verify_domain = true
+  verify_dkim = true
+}
\ No newline at end of file
diff --git a/terraform/modules/ses/variables.tf b/terraform/modules/ses/variables.tf
new file mode 100644
index 00000000..14d05e40
--- /dev/null
+++ b/terraform/modules/ses/variables.tf
@@ -0,0 +1,14 @@
+variable "project_name" {
+  description = "Name of the project, used in resource naming"
+  type        = string
+}
+
+variable "environment" {
+  description = "Environment name"
+  type        = string
+}
+
+variable "domain_name" {
+  description = "The app's domain name."
+  type = string
+}
\ No newline at end of file
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 27b85db3..eeea2135 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -16,119 +16,8 @@ variable "domain_name" {
   default     = "demo.codeforamerica.ai"
 }
 
-# variable "vpc_cidr" {
-#   description = "CIDR block for VPC"
-#   type        = string
-#   default     = "10.0.0.0/16"
-# }
-#
-# variable "public_subnet_cidrs" {
-#   description = "CIDR blocks for public subnets"
-#   type        = list(string)
-#   default     = ["10.0.1.0/24", "10.0.2.0/24"]
-# }
-#
-# variable "private_subnet_cidrs" {
-#   description = "CIDR blocks for private subnets"
-#   type        = list(string)
-#   default     = ["10.0.3.0/24", "10.0.4.0/24"]
-# }
-
-# Database Configuration
-# variable "db_instance_class" {
-#   description = "RDS instance class"
-#   type        = string
-#   default     = "db.t3.small"
-# }
-
-# variable "db_allocated_storage" {
-#   description = "Allocated storage for RDS instance in GB"
-#   type        = number
-#   default     = 20
-# }
-
-# variable "db_name" {
-#   description = "Name of the database"
-#   type        = string
-#   default     = "access_pdf_production"
-# }
-
-# variable "db_username" {
-#   description = "Master username for the RDS instance"
-#   type        = string
-#   default     = "asap_pdf"
-# }
-
-# Redis Configuration
-# variable "redis_node_type" {
-#   description = "ElastiCache node type"
-#   type        = string
-#   default     = "cache.t3.micro"
-# }
-
-# variable "redis_port" {
-#   description = "Port for Redis"
-#   type        = number
-#   default     = 6379
-# }
-
-# Container Configuration
-# variable "container_port" {
-#   description = "Port the container listens on"
-#   type        = number
-#   default     = 3000 # Rails default port
-# }
-
-# variable "container_cpu" {
-#   description = "CPU units for Fargate task (256 = 0.25 vCPU, 512 = 0.5 vCPU, 1024 = 1 vCPU)"
-#   type        = number
-#   default     = 1024 # 1 vCPU
-# }
-#
-# variable "container_memory" {
-#   description = "Memory for Fargate task in MiB (Valid values: 512, 1024, 2048, 3072, 4096, etc.)"
-#   type        = number
-#   default     = 2048 # 2GB memory
-# }
-
-# GitHub Configuration
-# variable "github_repository" {
-#   description = "GitHub repository in format owner/repo"
-#   type        = string
-# }
-
-# Application Configuration
-# variable "rails_master_key" {
-#   description = "Rails master key for the application"
-#   type        = string
-#   sensitive   = true
-# }
-
-# variable "aws_account_id" {
-#   description = "AWS Account ID"
-#   type        = string
-# }
-
 variable "aws_region" {
   description = "AWS Region"
   type        = string
   default     = "us-east-1"
 }
-
-# variable "secret_key_base" {
-#   description = "Rails secret key base for production"
-#   type        = string
-#   sensitive   = true
-# }
-
-# variable "google_ai_key" {
-#   description = "Google/Gemini API Key"
-#   type        = string
-#   sensitive   = true
-# }
-#
-# variable "anthropic_key" {
-#   description = "Anthropic API Key"
-#   type        = string
-#   sensitive   = true
-# }