Settings & Team
Invite people, set roles and access, and configure how your organisation rates risk.
14 min read10 sectionsAll roles (team, access and configuration are owners and admins only)
Settings is where you manage your own alerts and sign-in security, ask an owner to add someone, and, if you are an owner or admin, the people in your organisation, what each of them can see, and how your organisation rates risk. Use this guide when you invite or request someone, change their access, or adjust your scales and categories.
Open Settings at the bottom of the sidebar. The sections you see depend on your role.
| Section | Who sees it | What it is for |
|---|---|---|
| Notifications | Everyone | Your alert emails, and the organisation-wide switch (owners) |
| Security | Everyone | Password, two-factor authentication and trusted devices |
| Your Organization Access | Admins and members | The units you can see |
| Tenant Settings | Everyone | Organisation name, slug and data region |
| Tenant Configuration | Owners and admins | The configuration wizard and rating scales |
| Billing & Subscription | Owners and admins | Plan, seats and payment details |
| Request a New User | Admins and members | Ask an owner to add someone |
| Organization Management | Owners and admins | Team members, invitations and the access log |
| Incident Reporting | Owners and public report handlers | Public reporting links, the reports they receive, and who handles them |
| Danger Zone | Owners only | Delete organization |
Roles
- Owner
Sees every unit, present and future. Manages admins, members, org units and settings. Only owners can make someone an owner or delete the organisation.
- Admin
Sees only the units they are assigned. Approves proposals, and invites and manages members and org units inside those units — never owners or other admins.
- Member
Sees only the units they are assigned. Works with records there and proposes changes for an owner or admin to approve.
- Setup owner
The one owner who can change another owner's access. Nobody else can change or remove them.
Owners and admins invite people from Organization Management → Team Members.
- 1
Click Invite Member
On a Solo plan the button is disabled once you have one user. Use Upgrade to Team under Billing & Subscription to add more.
- 2
Fill in the invitation
The What this grants panel updates as you choose, listing what the person will see, what is withheld and what they can manage.
- 3
Click Send Invitation
The dialog then shows the Invitation link. Click Copy invitation link and keep it as a backup — it is shown only once.
The invitation form
- Email Addressrequired
Where the invitation is sent.
- Role
Owner - Full control (offered to owners only), Admin - Can manage team and settings or Member - Regular user access.
- Information access
Public only or Public + Confidential.
- Legal privilege
Non-privileged only or Privileged + non-privileged.
- Handles public incident reports
Shown to owners inviting an admin or member. Ticked, the person receives public incident report emails and triages them for the whole organisation. Owners always handle public reports. See Incident reporting links.
- Visibility Scope
Shown for every role, owners included. Leave it on Whole business for every unit, present and future, or tick units. Each tick grants that unit only; ticking a parent does not include its sub-units.
Owners and admins can invite people directly; anyone else can ask from the Request a New User card on the Settings page, and an owner reviews the request.
- 1
Click Request a new user
Opens a short form.
- 2
Fill in the request
Name and Email are required. Suggested unit offers only units you can see; Note is a place to say their role or why they need access.
- 3
Click Send request
Every current owner is notified, by bell and email, that someone asked for a new user.
Nobody is invited and no seat is used until an owner reviews the request. Opening it from the notification takes an owner straight to the Invite dialog, pre-filled from the request; they still choose the role and access themselves. See Invite people.
Each row of Team Members shows the person's role, their Confidential and Privileged switches, and actions.
- 1
Flip a switch in the Access column
Grants or removes Confidential or Privileged access straight away.
- 2
Or click Role & Access
The Change Role & Access dialog sets New Role, Information access and Legal privilege, with a preview of the result. Owners also see Handles public incident reports for an admin or member; it keeps the person's current setting until you change it, whatever role you choose. Click Update Role.
- 3
Click Remove to take someone out
Confirm with Remove Member. This cannot be undone.
Changing a role does not change which units someone sees. Assign units in the organisation structure.
The Setup owner badge marks the owner who can change other owners. Only they can switch their own Confidential and Privileged access, confirmed with an emailed code. To hand the role on, they click Transfer setup ownership, choose another owner, click Email me a code, enter it and click Transfer; they remain an owner.
Below the tables, the Access log lists every user creation and access change, newest first.
Two grants decide whether a person can open sensitive records in the units they can see.
- Public only
Opens Public records only.
- Public + Confidential
Also opens Confidential records.
- Non-privileged only
Cannot open legally Privileged records.
- Privileged + non-privileged
Also opens legally Privileged records.
The grants apply across the whole organisation, and to owners too: an owner without the Confidential grant cannot open Confidential records. Inviting an owner switches both on by default, as far as you hold them yourself. Forms that set a record's level offer Confidential and Highly sensitive only if you hold the Confidential grant, and Privileged only if you hold the Privileged grant. You can see your own grants on User Profile under Classification access and Privilege level.
Units form the hierarchy that owns every record, and assigning people to units decides what they see.
Owners and admins click Edit Tenant Configuration and go to the Organization Structure step. The tree starts at Whole Business; tiers are the layers under it (for example Division, Department) and units sit inside a tier. Hover a unit to see its actions. Admins can only change units inside their own access. Changes apply immediately.
- 1
Add a unit
Click Add tier for a new layer under Whole Business, or open a unit's menu and choose Add sub-unit. Enter a Name, Slug and Type.
- 2
Rename or move it
Use Rename, or Move… and pick a New parent.
- 3
Delete it
Delete also removes its sub-units. If they still own records, pick a unit under Move records to; the button becomes Move & delete.
- 4
Assign people
Click Users on a unit, choose a teammate under Add member, then click Assign. Remove someone with the X.
Owners and admins find these under Tenant Configuration. Anyone can open the pages; only owners and admins can edit them.
Edit Tenant Configuration
A five-step wizard: Basic Information, Taxonomy, Risk Appetite, Organization Structure, Review & Save.
Control Effectiveness Scale
Start from Simple (three levels) or Advanced (five), then set each level's Name, Color, Weight (0–100) and Reporting band. Up to 10 levels.
Severity Labels
Choose Standard (4 bands) or Granular (5 bands), then edit each band's Display label, Threshold (min score) and Color. Click a heatmap cell to override its band.
Likelihood & Impact Scales
Rename level labels and criteria, rename the eight standard impact headings, or click Add Dimension to add your own.
Category Risk Tolerance
The highest band each top-level risk category accepts. Risks rated above it are flagged Over tolerance. Not set means no flag.
In the wizard, Basic Information holds your organisation's details and the Require second approver switch: when on, nobody can approve their own proposal. Risk Appetite sets the Treatment Plan Threshold (a risk whose residual severity reaches it prompts a treatment plan) and the Risk Score Scope (whether the risk register and dashboard heatmap open on residual or inherent ratings). Click Save Configuration on the last step.
Taxonomies are the category lists your registers use, each with categories and one level of subcategories.
- Risk
Categories for risks, used in reporting and category tolerance.
- Incident
Categories for incidents and events.
- Root Cause
Root causes linked to incidents or control failures.
- Control
Categories and subcategories for controls.
In the wizard's Taxonomy step, choose per tree:
- Apply Standard Template resets the tree to the ShelfGRC standard set. Categories outside it are archived after you confirm.
- Custom Taxonomy opens the taxonomy manager in a new tab and, after you confirm, archives the tree's existing categories so you can build your own.
Manage Categories opens the Taxonomy Management page, with a tab for each tree. There, owners and admins can Add Category, Apply Template, Import, and archive or restore categories — archiving a category that still has an active subcategory is refused; archive the subcategory first. Everyone can Export CSV, Export JSON and Show Archived. On the Risk tab, Apply Template offers the 52 Risks Framework; the other trees each offer their own ShelfGRC standard set.
Owners, and the people they choose to handle public reports, can let anyone report an incident without a ShelfGRC account.
- 1
Click New Link
Under Incident Reporting Links.
- 2
Fill in the link details
All three fields below are optional.
- 3
Click Create & Copy Link
Share the URL with the people who should be able to report.
- Public heading
Shown to anyone who opens the link. Keep case names and confidential detail out of it.
- Expiry date
Leave blank for 12 months from today. A link showing Never accepts reports indefinitely.
- Max submissions
Leave blank for unlimited.
Each link has buttons to copy the URL, open the form, edit, disable or enable, and delete. Submissions arrive in Public Incident Reports below. Accept turns a report into an incident proposal for the owner you choose to approve; Reject closes it. See the Incidents guide.
Who handles public reports lists the owners, who always handle them, and everyone an owner has ticked Handles public incident reports for — when inviting them or in Change Role & Access. Handlers get an email and a bell notification for each new report and can accept or reject it, whatever their role. Only an owner can change who handles them.
Everyone manages their own alerts and sign-in security here, and their photo on User Profile.
Notifications
- Organisation notification emails
Owners only. Off stops every alert email for everyone. Alerts still appear in the app, and sign-in, password, invitation and billing emails still send.
- Email notifications
Your master switch for optional mail. Alerts for records you are accountable for still send.
- Weekly digest
A weekly roll-up of overdue items and reviews.
- Owner assignment alerts
Email when you are made owner of a risk rated in your High band or above.
- Daily admin roll-up
Owners and admins. A daily summary of what changed.
- What you'll be told about
Every alert, by register, with how often it repeats. Always on alerts cannot be switched off and stop when the record changes.
Under Security, Set Up MFA walks you through scanning a QR code with an authenticator app, entering its 6-digit code and saving your backup codes, which are shown only once. Trusted Devices lists the devices you have signed in from; a new one triggers a security email. Owners and admins also see MFA Reset Requests: approving one removes that person's authenticator so they can set it up again.
On User Profile, hover your photo to upload a new one (PNG, JPEG, WebP or GIF, up to 5 MB). The page also shows your role and access grants, Log Out and Delete account.