Roles and permissions
Owner, administrator, member and viewer – who can do what.
Every member of an organisation has one of four roles. Permissions are checked both in the application and directly in the database.
The roles
- Owner – full control, including the subscription and appointing other owners.
- Administrator – manages assets, members and settings.
- Member – works on findings, starts scans and creates reports.
- Viewer – sees the security posture but cannot change anything. Suits management, the board or auditors.
Permissions
| Permission | Owner | Administrator | Member | Viewer |
|---|---|---|---|---|
| View the security posture, assets and findings | ● | ● | ● | ● |
| Change the organisation's details | ● | ● | – | – |
| Invite and manage members | ● | ● | – | – |
| Add and remove assets | ● | ● | – | – |
| Verify domains | ● | ● | – | – |
| Manage the API inventory and import specifications | ● | ● | – | – |
| Start scans | ● | ● | ● | – |
| Change status, assign and comment on findings | ● | ● | ● | – |
| Accept risks and mark false positives | ● | ● | – | – |
| See details of data breaches | ● | ● | ● | – |
| Manage data breaches | ● | ● | ● | – |
| Create reports | ● | ● | ● | – |
| Register and manage incidents | ● | ● | ● | – |
| Delete incidents and logged reports | ● | ● | – | – |
| Read the audit log | ● | ● | – | – |
| Change monitoring and security settings | ● | ● | – | – |
| Manage the subscription | ● | – | – | – |
Rules that always apply
- An organisation must always have at least one owner.
- Only owners can give or remove the owner role.
- Anyone can leave an organisation themselves.
- Role changes and removals are recorded in the audit log.
Invitations
Invitations are created by administrators, are valid for seven days and can only be accepted by the email address they were sent to – after the address has been confirmed. The number of members is limited by the subscription.