Roles and invitations
Owner, admin, member and viewer, with invitations that expire and an audit trail.
| Role | Can |
|---|---|
| Owner | Everything, including billing, plan changes, deleting the organization and managing owners. |
| Admin | Manage sites, repositories, people, notifications and the audit log. Not billing. |
| Member | Run scans, work findings, dismiss with a reason, ask for AI tasks. |
| Viewer | Read findings, reports and history. Change nothing. |
Invitations
- An invitation is sent to an email address with a role attached.
- It expires, so a forgotten invite does not become a way in months later.
- Accepting requires a verified email address.
- Sending, accepting, revoking and role changes are all written to the audit log.
Viewer is for clients
If a client wants to see their own security posture, give them a viewer seat rather than a copy of a PDF or, worse, a shared login.
Questions
How many people can I have?
One on Free, three on Pro, five on Studio, ten on Agency and fifty on Team.
Can there be more than one owner?
Yes, and for anything that matters there should be. An organization with one owner has a single point of failure.
What happens when I remove someone?
Their access ends immediately and their sessions stop working. What they did stays in the audit log.
Something here wrong, missing or out of date? Tell us and we will fix the page.