Skip to main content

Team Roles & Permissions

Each team member has one of three roles.

  • Admin has full control. An admin manages settings, the team and billing.
  • Member can read and triage. Some report actions need an admin, for example setting the status directly, closing a report or marking a duplicate.
  • Auditor has read-only access for an external assessor or a notified body. An auditor account can have an access expiry date.

The portal has no other roles, and you cannot make custom roles. The audit log records actions that change data.

The number of team seats depends on your plan. Free has 1 seat, Reporting has 3, Compliance has 5 and Enterprise has 10.

Inviting Team Members​

Only company administrators can invite people to a team. An administrator never sets another person's password. The portal sends an invitation link, and the invited person sets their own password.

Steps to Send an Invitation​

  1. Open Settings and select Team.
  2. Select Invite Member.
  3. Type the email address of the person. A name is optional.
  4. Select the role: Member, Admin or Auditor.
  5. For an Auditor, set an access expiry date if the access must stop on a date.
  6. Select Send Invitation.

Auditor accounts need the Reporting plan or higher, the same plan as the Invite Member form.

The person receives an email with a link. The link is valid for 7 days.

Accepting an Invitation​

  1. Open the link in the invitation email.
  2. Type a password of at least 8 characters and confirm it.
  3. Read the Terms of Service and the Privacy Policy, then select the agreement box.
  4. Select Activate account.

The portal records the date and the version of the terms that the person accepted.

The portal makes the account and signs the person in.

Pending Invitations​

The Pending Invitations table lists every invitation that is not yet accepted and not yet expired.

  • Seat use: A pending invitation holds a team seat. This prevents a company from sending more invitations than its plan allows.
  • Second seat check: The portal checks the seat limit again when the person accepts. An invitation sent 7 days ago cannot exceed a limit that changed in the meantime.
  • Revoke: Select Revoke to cancel an invitation. The emailed link stops working immediately and the seat is released.
  • Resend: Select Resend to send the invitation again. The portal makes a new link, the previous link stops working, and the 7-day period starts again.
  • Correct an invitation: Send a new invitation to the same address to correct a role. The previous link stops working.

When the Invitation Email Is Not Delivered​

Sometimes the email provider does not deliver the invitation. This occurs when the provider refuses the message, or when mail to the address bounced before and the provider now blocks all email to it.

When this occurs, the Team page shows a red message, "Email not delivered to" and the address. The message gives the reason. The invitation stays in the Pending Invitations table and keeps its seat.

To give the person access:

  1. Select Copy invite link in the message.
  2. Send the link to the person through a different channel, for example chat.
  3. Alternatively, ask the person to check the address and its mailbox, then select Resend.

The link shows only once, because the portal stores only a hash of the token. Anyone with the link can join the workspace until it expires. Send it only to the person you invited. If you lose the link, select Resend to make a new one.

Security and Audit​

  • Token storage: The portal stores only the SHA-256 hash of the invitation token. The token itself exists only in the email, and in the Team page message when the email is not delivered.
  • Auditor limit: A company can have at most 5 auditor accounts. Pending auditor invitations count against this limit.
  • Refused sign-in: When an auditor tries to sign in after the access expiry date, the portal refuses the sign-in and records a LOGIN_REFUSED_ACCESS_EXPIRED event. The Access Report shows it as "Refused, access ended".
  • Audit logging: The portal records TEAM_INVITATION_SENT, TEAM_INVITATION_RESENT, TEAM_INVITATION_EMAIL_FAILED, TEAM_INVITATION_ACCEPTED, TEAM_INVITATION_EXPIRED and TEAM_INVITATION_REVOKED events in the audit log.

Changing an Auditor's End Date​

Only company administrators can change the date on which an auditor's access ends.

  1. Open Settings and select Team.
  2. Find the auditor in the Team Members table.
  3. Select Change end date in the Actions column.
  4. Pick a date within one year. Access ends at the end of that day, UTC.
  5. Select Save End Date.
  • Earlier or later: You can shorten or extend the access. To extend it, the company needs the Reporting plan or higher. To shorten it, no plan is needed.
  • New sign-in: The change signs the auditor out at once. At the next sign-in the new date applies. An auditor whose access ended can sign in again after you extend it.
  • Audit logging: The portal records a TEAM_MEMBER_ACCESS_EXPIRY_CHANGED event with the old and the new date.

Removing Team Members​

Only company administrators can remove members from a team.

Steps to Remove a Member​

  1. Open Settings and select Team.
  2. Find the team member in the Team Members table.
  3. Select Remove in the Actions column.
  4. Review the confirmation dialog.
  5. Select Remove Member to complete the action.

Removal Limits and Behavior​

  • Current user restriction: An administrator cannot remove their own current user account. Another administrator must remove the account if required.
  • Last administrator protection: An administrator cannot remove the last administrator of the company. The company must retain at least one administrator.
  • Access revocation: Removal immediately revokes all active sign-in sessions for the removed user.
  • Ownership cleanup: Removal clears coordinatorId assignments on active submissions and clears ownerUserId and ownerEmail assignments on compliance controls.
  • Audit logging: The portal records a TEAM_MEMBER_REMOVED event in the audit log with the administrator ID and timestamp.