Open Members to invite teammates by email. They must sign in with that same email to accept the invite link and join with the role you choose. Invite links expire after 7 days. You get an email when they accept.
Role summary
- Owner: Full control, including billing, org deletion, and ownership transfer.
- Admin: Manage projects, settings, members, and integrations. Can activate new projects and view billing.
- Editor: Import, review, publish, export, and view security findings. Cannot activate a draft project or manage members.
- Viewer: Read-only access to inventory and downloads on active projects.
- Finance: View and manage billing, and select organization members for SourceTrust receipts and billing emails. Cannot manage members. Project and package access is limited to projects where they are a project lead.
Common permission boundaries
- Activate project: Owner and admin only, using available free or paid project capacity. First publish activates a draft; first export also requires activation in In-app only / export or Public page and in-app export mode. Public page mode exports do not activate drafts.
- Restore any archived project, as draft or active: Owner and admin only.
- Manage billing (subscribe, change plan): Owner and finance.
- Custom domain DNS setup: Owner, admin, or finance.
Invitations
- Invite links expire after 7 days. Cancelled or expired invites can no longer be accepted. Removing a member or cancelling an invite asks for confirmation first.
- You can invite someone as a pending Project lead from project settings or create-project. They are invited as a viewer; after accept they become a lead on that project only (elevation, not org-wide editor). See Help center → Project leads (Project leads).