Teams + Roles

Invite teammates, assign roles, scope access to specific projects. Sectora uses row-level security so users only see findings their role grants.

Organizations

Every Sectora account starts in an organization (created automatically on signup). The org owns: scans, findings, Shield sites, integrations, billing. Users can belong to multiple orgs and switch via the org picker top-left.

Roles

Owner
Full access. Can delete the org. Manages billing. Promotes others to Owner.
Admin
All operational access + invite users + manage integrations + view audit log. Can't delete the org or change billing.
Member
Create + run scans, triage findings, view Shield config. No integration/billing access.
Viewer
Read-only. Can see findings + Shield analytics but not run new scans.
Auditor
Read-only PLUS audit log access. For compliance teams who need to verify but not change.

Inviting teammates

  1. Settings → Team → + Invite
  2. Enter email + select role
  3. Optional: scope to specific projects/scans (see below)
  4. Invite email goes out; recipient clicks the link, signs in (magic link or SSO), lands in your org

Invites expire after 7 days. Resend or revoke from the same page.

Project-scoped access

Members and Viewers can be scoped to specific projects — useful when team A shouldn't see team B's scans. Projects are created at Settings → Projects; scans are assigned to a project at creation time.

Owners and Admins always see everything regardless of project scoping (otherwise nobody could audit).

Row-Level Security (under the hood)

Access control isn't just UI filtering. Postgres RLS policies enforce that every query a logged-in user makes is restricted to their own org's data. Even if a bug in our code tried to query across orgs, the database refuses. Same protection applies to RLS-aware admin tools.

Audit log

Every user-initiated action lands in the audit log: who did what, when, from where. Includes scan triggers, finding-status changes (mark FP, mark fixed), integration connect/disconnect, role grants, invite sends.

Retention: 90 days on Pro, 1 year on Business, unlimited on Enterprise. Export to CSV from Settings → Audit Log → Export. Webhook-stream the log to your SIEM for live monitoring (Settings → Webhooks → Audit log).

SCIM provisioning (Enterprise)

For Enterprise orgs that want IdP-driven user lifecycle, Sectora supports SCIM 2.0. When you provision a user in Okta/Azure AD, they appear in Sectora; deprovision removes them. Role mapping configurable via IdP groups.

Configure at Settings → SCIM. Provide your IdP's SCIM endpoint; Sectora issues a SCIM bearer token.

Service accounts

For CI/CD that needs more than the standard API key permissions, create a service-account user at Settings → Team → + Service account. A service account is a non-human member of the org with its own role + API key. Best practice: one per pipeline, with the narrowest possible scope.

What's next