Skip to main content

Team Roles & Permissions

Effective vulnerability management requires strict access control and clearly delineated responsibilities. The CVD Portal implements a robust Role-Based Access Control (RBAC) system designed to align with the Cyber Resilience Act (CRA) requirements for data minimization and secure handling of sensitive vulnerability information. By assigning specific roles to your team members, you ensure that individuals only have access to the data necessary for their specific functions.

The portal provides several predefined roles: Administrators, Triage Coordinators, Technical Assessors, and Compliance Officers. Administrators have global access to portal settings and user management. Triage Coordinators are the first line of defense, responsible for initial intake, validation, and communication with external researchers. Technical Assessors are granted access to specific vulnerability details required to reproduce and patch the issue, while Compliance Officers have read-only access to audit logs and SLA metrics to ensure regulatory adherence.

Custom roles can also be configured to meet the unique structural needs of your organization. Every action performed within the portal, regardless of the assigned role, is immutably logged to provide a comprehensive audit trail. This level of granular control and accountability is vital for demonstrating compliance during regulatory audits and maintaining the confidentiality of unpatched vulnerabilities.

Inviting Team Members​

Only company administrators can invite people to a team. An administrator never sets another person's password. The portal sends an invitation link, and the invited person sets their own password.

Steps to Send an Invitation​

  1. Open Settings and select Team.
  2. Select Invite Member.
  3. Type the email address of the person. A name is optional.
  4. Select the role: Member, Admin or Auditor.
  5. For an Auditor, set an access expiry date if the access must stop on a date.
  6. Select Send Invitation.

The person receives an email with a link. The link is valid for 7 days.

Accepting an Invitation​

  1. Open the link in the invitation email.
  2. Type a password of at least 8 characters and confirm it.
  3. Select Activate account.

The portal makes the account and signs the person in.

Pending Invitations​

The Pending Invitations table lists every invitation that is not yet accepted and not yet expired.

  • Seat use: A pending invitation holds a team seat. This prevents a company from sending more invitations than its plan allows.
  • Second seat check: The portal checks the seat limit again when the person accepts. An invitation sent 7 days ago cannot exceed a limit that changed in the meantime.
  • Revoke: Select Revoke to cancel an invitation. The emailed link stops working immediately and the seat is released.
  • Re-send: Send a new invitation to the same address to correct a role or an address error. The previous link stops working.

Security and Audit​

  • Token storage: The portal stores only the SHA-256 hash of the invitation token. The token itself exists only in the email.
  • Auditor limit: A company can have at most 5 auditor accounts. Pending auditor invitations count against this limit.
  • Audit logging: The portal records TEAM_INVITATION_SENT, TEAM_INVITATION_ACCEPTED, TEAM_INVITATION_EXPIRED and TEAM_INVITATION_REVOKED events in the audit log.

Removing Team Members​

Only company administrators can remove members from a team.

Steps to Remove a Member​

  1. Open Settings and select Team.
  2. Find the team member in the Team Members table.
  3. Select Remove in the Actions column.
  4. Review the confirmation dialog.
  5. Select Remove Member to complete the action.

Removal Limits and Behavior​

  • Current user restriction: An administrator cannot remove their own current user account. Another administrator must remove the account if required.
  • Last administrator protection: An administrator cannot remove the last administrator of the company. The company must retain at least one administrator.
  • Access revocation: Removal immediately revokes all active sign-in sessions for the removed user.
  • Ownership cleanup: Removal clears coordinatorId assignments on active submissions and clears ownerUserId and ownerEmail assignments on compliance controls.
  • Audit logging: The portal records a TEAM_MEMBER_REMOVED event in the audit log with the administrator ID and timestamp.