Team, roles, and organizations

One team per account

Your account holds everything: the subscription, the team, the organizations, and the sites inside them. Everyone you add joins the account itself, with a single role. Owners and admins always have the whole account. A member or a viewer has either the whole account or only the organizations named on their seat, and sees just the sites in those. There's no per-site access. That's the most useful thing to know on this page, because most of what follows comes from it.

What roles are there?

There are four roles, ranked. From the top:

• Owner: can do everything, including billing and granting ownership. Only an owner can start or change the subscription, redeem a coupon, delete a site outright, or change how long consent records are kept.
• Admin: manages sites and the team, which includes inviting people, changing roles, removing members, archiving a site and changing a site's domain. Admins can't touch billing and can't act on owners.
• Member: the working role. Members run scans, categorize and approve cookies, publish banners and documents, add sites, and create and arrange organizations.
• Viewer: read-only. A viewer can open every page, including Team and Billing, but can't change anything.

Publishing a banner is a member job, and deleting a site is an owner job. Archiving sits between them. An admin can archive because the site's records survive it, but deleting erases the evidence, so only the top role can do it.

Rules for team actions

Three rules apply to every team action. Each one is checked against the database on every request, so it doesn't matter what the browser claims:

• You can't act on someone who outranks you. An admin can't change or remove an owner, and only an owner can invite one.
• You can't hand out a role above your own.
• You can't change your own role or remove yourself. This prevents self-service promotion and accidental lockout.

One more rule sits above those. The account always keeps at least one owner. The application refuses to demote or remove the last owner, and a database constraint refuses it again in case the application is ever wrong.

How do invites work?

An invite is an email address and a role. UserGuard emails the person a link and shows you the same link, so you can pass it along another way. If the email never arrives, the link alone is enough. Links expire after 7 days.

• The link is shown once. The server stores only a hash of it, so the original can't be resent. If a link is lost, regenerate the invite. You get a fresh link and the old one stops working. Revoking cancels the invite entirely.
• One open invite per address. Inviting the same address again replaces the earlier invite, and the earlier link stops working.
• Accepting is signing in. The invited person signs in to an existing UserGuard account or creates one on the spot. An account created this way is bound to the invited address. If they've already joined your team some other way in the meantime, accepting the invite never overwrites the role they hold.

Organizations are folders for sites

Organizations group the sites inside one account. The account holds the billing and the team, and every site lives in exactly one organization. An agency puts each client's sites in their own organization, names it after the client and gives it a color, and the dashboard keeps the clients apart.

An organization isn't a workspace. The team and the billing stay on the account, and everyone holds one role across all of it, so an admin on the account is an admin over every organization in it. What an organization can do is limit what a member or viewer sees. A seat limited to organizations shows only the sites in the ones named on it, while owners and admins see every organization. A whole-account seat picks up organizations added later. A limited seat picks up none until an admin adds it on that organization's Members page. If even your owners and admins must never see two clients side by side, you need two accounts, because two organizations won't give you that boundary.

Every account starts with one organization, and you can't delete the last one, because sites have to live somewhere. You also can't delete an organization that still holds sites, including archived ones. Move them first.

Moving a site between organizations

Any member can move a site to another organization on the account. Nothing else changes. Scan history, published documents, consent records and the bill are untouched, and the move is recorded in the account's audit log.

What organizations change, and what they do not

Organizations change how sites are grouped, named and colored. They don't change pricing. Volume discounts count every live site on the account, whichever organizations those sites are in, so ten clients split across ten organizations pay the same per-site rate as ten sites in one. The tiers themselves are in Billing, refunds, and how pricing works.