Skip to main content

Team Roles & Permissions

Each team member has one of three roles.

  • Admin has full control. An admin manages settings, the team and billing.
  • Member can read and triage. Some report actions need an admin, for example setting the status directly, closing a report or marking a duplicate.
  • Auditor has read-only access for an external assessor or a notified body. An auditor account can have an access expiry date.

The portal has no other roles, and you cannot make custom roles. The audit log records actions that change data.

The number of team seats depends on your plan. Free has 1 seat, Reporting has 3, Compliance has 5 and Enterprise has 10.

Inviting Team Members​

Only company administrators can invite people to a team. An administrator never sets another person's password. The portal sends an invitation link, and the invited person sets their own password.

Steps to Send an Invitation​

  1. Open Settings and select Team.
  2. Select Invite Member.
  3. Type the email address of the person. A name is optional.
  4. Select the role: Member, Admin or Auditor.
  5. For an Auditor, set an access expiry date if the access must stop on a date.
  6. Select Send Invitation.

The person receives an email with a link. The link is valid for 7 days.

Accepting an Invitation​

  1. Open the link in the invitation email.
  2. Type a password of at least 8 characters and confirm it.
  3. Read the Terms of Service and the Privacy Policy, then select the agreement box.
  4. Select Activate account.

The portal records the date and the version of the terms that the person accepted.

The portal makes the account and signs the person in.

Pending Invitations​

The Pending Invitations table lists every invitation that is not yet accepted and not yet expired.

  • Seat use: A pending invitation holds a team seat. This prevents a company from sending more invitations than its plan allows.
  • Second seat check: The portal checks the seat limit again when the person accepts. An invitation sent 7 days ago cannot exceed a limit that changed in the meantime.
  • Revoke: Select Revoke to cancel an invitation. The emailed link stops working immediately and the seat is released.
  • Re-send: Send a new invitation to the same address to correct a role or an address error. The previous link stops working.

Security and Audit​

  • Token storage: The portal stores only the SHA-256 hash of the invitation token. The token itself exists only in the email.
  • Auditor limit: A company can have at most 5 auditor accounts. Pending auditor invitations count against this limit.
  • Audit logging: The portal records TEAM_INVITATION_SENT, TEAM_INVITATION_ACCEPTED, TEAM_INVITATION_EXPIRED and TEAM_INVITATION_REVOKED events in the audit log.

Removing Team Members​

Only company administrators can remove members from a team.

Steps to Remove a Member​

  1. Open Settings and select Team.
  2. Find the team member in the Team Members table.
  3. Select Remove in the Actions column.
  4. Review the confirmation dialog.
  5. Select Remove Member to complete the action.

Removal Limits and Behavior​

  • Current user restriction: An administrator cannot remove their own current user account. Another administrator must remove the account if required.
  • Last administrator protection: An administrator cannot remove the last administrator of the company. The company must retain at least one administrator.
  • Access revocation: Removal immediately revokes all active sign-in sessions for the removed user.
  • Ownership cleanup: Removal clears coordinatorId assignments on active submissions and clears ownerUserId and ownerEmail assignments on compliance controls.
  • Audit logging: The portal records a TEAM_MEMBER_REMOVED event in the audit log with the administrator ID and timestamp.