# Members and roles

An account is one organization. Everyone in it sees the same projects, runs and credits, and there is no charge per person.

## Inviting people

Go to **Settings → Members** and press **Add member**. Enter their email address and choose a role. They get an email with a link that opens sign-up already holding that address, and their seat is claimed when they sign in with it. Until then they show as **Invited, not joined yet**.

## Roles

Each person has one role, and each role can do everything the one below it can:

| | Owner | Admin | Tester | Viewer |
|---|---|---|---|---|
| Close the account | ✓ | | | |
| Manage members, roles and API keys | ✓ | ✓ | | |
| Add or delete an app or platform | ✓ | ✓ | | |
| Record, check, run, schedule, load-test | ✓ | ✓ | ✓ | |
| Read everything and download reports | ✓ | ✓ | ✓ | ✓ |

- **A viewer can download every report.** A manager or an auditor who only needs the PDF can have a seat without being able to change anything.
- **An API key acts as a tester.** It can run and read, but cannot add members, create keys or delete anything.
- **An account always has an owner.** The last owner cannot be removed or demoted, and only an owner can make someone else an owner.

The portal shows each person only the buttons their role can use.

## Signing in

People sign in with an email and password, or with Google or GitHub. Under **Settings → Your account** each person can change their name, email and password, set up two-factor sign-in with an authenticator app, and link or unlink Google and GitHub.

## Single sign-on

With **Monthly credits**, your people can sign in through your company's own directory: **Microsoft Entra ID** (Azure AD), **ADFS**, Okta, Google Workspace, or anything that speaks **SAML** or **OIDC**. They use their work account, your directory's rules apply (two-factor, password policy, approved devices), and somebody who leaves your company loses access to BitAssure when you disable them in your directory.

An owner or admin sets it up under **Settings → Single sign-on**:

1. **Prove your domain.** Enter it, such as `yourcompany.com`, and add the TXT record shown at your DNS provider. Only addresses at that domain (and its subdomains) can sign in through your directory.
2. **Connect your directory.** Choose Microsoft Entra ID, SAML or another OIDC directory. The page shows the address to enter on your directory's side and the steps for each.
3. **Choose the role** people get the first time they sign in this way: viewer, tester or admin. You can change anyone's role afterwards under **Members**.
4. **Require it, if you want.** Once an admin or owner has signed in through your directory once, you can make it the only way in: password, Google and GitHub sign-ins at your domain are then refused, with a message saying how to sign in.

To sign in, people choose **Sign in with your company (SSO)** on the sign-in page and enter their work address. They are taken to your company's sign-in, and come back into your BitAssure account.

**Removing someone sticks.** If you remove a member under **Members** while your directory still lets them sign in, they are not let back in. They are told so, and can choose to **ask to be let back in**. If they do, your owners and admins get an email and the request waits at the top of **Members**: **Approve** lets them in with the role you choose, **Dismiss** keeps them out. Inviting them again under **Members** also lets them back in. If somebody has left your company, disable them in your directory too.

Turning single sign-on off keeps everyone's account and role; they sign in another way.

## Closing the account

An owner can close the account under **Settings → Organization → Close the account**, by typing the account's name to confirm. Closing is permanent: every project, journey, run, report and recording is deleted, and every member's sign-in with it.

It cannot be closed while a run or recording is going on, while a refund is being decided, or while Monthly credits are set to renew. The page says which of these is in the way. Payment records stay with Paddle, and backups age out within 30 days.