Organizations
Set up and run an organization — its members, companies, permission profiles, sign-in policy, storage and settings.
An organization is the top level of Gamma. It holds your projects, the people who work on them, their companies, and the rules for what each of them may do.
This page is for owners, security admins and admins. Project creators, members and guests work inside the projects they are on.
Who can do what
Each person has one role per organization: you can be an owner in one and a member in another. It has nothing to do with being a platform admin.
From most to least access: Owner, Security admin, Admin, Project creator, Member, Guest.
| Owner | Security admin | Admin | Project creator | Member | Guest | |
|---|---|---|---|---|---|---|
| Open the organization pages (Insights, Members, Settings, …) | Yes | Yes | Yes | No | No | No |
| See every project in the organization | Yes | Yes | Yes | Only the ones they are on | Only the ones they are on | Only the one they were invited to |
| Create projects | Yes | Yes | Yes | Yes | No | No |
| Invite people, change roles, remove people | Yes | Up to security admin | Up to admin | No | No | No |
| Manage companies and permission profiles | Yes | Yes | Yes | No | No | No |
| Change the sign-in policy, single sign-on and storage | Yes | Yes | No | No | No | No |
| Rename the organization, change its slug or logo | Yes | Yes | Yes | No | No | No |
| Delete the organization | Yes | No | No | No | No | No |
A security admin is an admin who also looks after how people sign in and where the files go: the two-factor requirement, single sign-on and storage. Admins do not manage those.
A project creator is a member who can also create projects. They become the admin of each project they create and run it like any project admin, but renaming or deleting it stays with the organization's admins. They have no access to the organization pages.
Nobody gives a role above their own, or changes or removes someone who holds one: an admin can give roles up to admin, a security admin up to security admin, and only an owner can make someone an owner.
A guest is someone invited to a single project rather than to the organization. They have no access to the rest of it. Nobody picks the guest role; accepting a project invitation is what makes you one.
Owners, security admins and admins can do everything inside every project. Project creators, members and guests get what their permission profile on that project allows.
Getting an organization
Organizations are created by a platform admin in the admin panel with New organization. They nominate an owner and are not added as a member themselves.
Every new organization starts with five permission profiles, so you can add people to projects straight away.
If you belong to more than one, switch with the organization switcher in the header.
Insights
Insights is the overview of an organization, for its owners, security admins and admins. It is a dashboard of widgets that any of them can add to, change, resize, move or remove. If the organization has no owner, a warning says so at the top.
It starts with:
- Account hygiene: Dormant accounts (no sign-in in the last 90 days), people Without two-factor, and Ageing passwords (unchanged for over a year, so never checked against known breaches). Select a part of the chart to open Members with the matching filter set.
- Members, Pending invitations (sent, still valid, not yet accepted) and members by role.
- Projects: each project with its members, open and overdue issues, open forms and last activity. Select a row to open the project.
- The changes made in the organization's projects, and the people who made the most.
- Storage used in all and by project, and how it has grown.
- Open issues by project, and active users.
The Day · Month · Year switch at the top shows every widget over the last 30 days, 12 months or 5 years; Each widget's own keeps each one's period.
Members
Members lists everyone in the organization together with pending and expired invitations. Filter by status or by account security (for example Needs attention), and search by name or email.
Invite people
Each person receives an email with an Accept invitation button. The invitation expires in 48 hours. They are asked to sign in first, and accepting adds the account they signed in with.
To invite someone to a single project as a guest, do it from that project's members page. See Projects.
An organization can have at most 100 pending invitations, its own and its projects' guest invitations together. When it is full, new invitations are refused until you cancel some.
Resend or cancel an invitation
Open the invitation's row in Members. Resend sends it again with a fresh expiry. Cancel invitation stops the link in the email from working; you can invite them again at any time.
To change the role of a pending invitation, open its row and pick another Organization role. The email already sent keeps working, and they join with the new role when they accept. The same limits apply as when inviting: only an owner can give an invitation the owner role or take it away, and only an owner or a security admin the security admin role. A guest invitation to a project has no organization role to change: cancel it and invite them to the organization instead.
Change someone's role
You cannot change your own role; ask another owner. A guest's role cannot be changed here either — invite them to the organization to make them a member.
The detail panel also shows Two-factor, Last sign-in, Password set and Invited by.
Remove someone
Open their row and choose Remove from organization. They lose access immediately. Their account is not deleted, and you can invite them back later. If they were in a company, that assignment is not restored when they come back.
Leave an organization
Open your own row in Members and choose Leave organization. You lose access immediately and need a new invitation to come back. If you are the only owner, hand ownership to someone else first.
Companies
A company is a business entity the organization works with — the main contractor, a subcontractor, the client. Each member can be in at most one company.
Companies matter for profiles marked Own company only: their holders see only the issues and forms their own company created, or that are assigned to them or their company. What they may change among those still follows their level: with Create, only their own.
Add a company
The registration number must be unique within the organization; names do not have to be. A website typed without https:// is saved with it, and only http:// and https:// addresses are accepted.
Put a member in a company
Open the person in Members and pick their company. Choose No company to clear it. Changes apply immediately.
Delete a company
Open it and choose Delete company. People in it stay in the organization, in no company. This cannot be undone.
Permission profiles
A profile sets what a project member may do with a project's content. Profiles are defined once per organization in Profiles and assigned per person on each project's members page, so the same person can be Field on one project and Viewer on another.
A profile gives one level per area:
| Level | What it allows |
|---|---|
| No access | Nothing; the area is hidden from them. |
| View | View. For markers, also move them from the AR app. |
| Create | View and create, then edit their own: issues and forms they created or that are assigned to them or their company, scopes they created and the statuses of those scopes' elements. |
| Edit | View, create and edit anyone's. |
| Full control | Everything, including delete. For forms, also reopen. |
Under each level, the profile sheet lists the actions it unlocks in that area:
| Action | What it means |
|---|---|
| View | See the area's content. |
| Move | Markers only: record where a printed marker sits in the model, as the AR app does when it is placed on site. |
| Create | Add new ones. |
| Edit own | Change what they created, or what is assigned to them or their company. |
| Edit | Change anyone's. |
| Reopen | Forms only: put a submitted form back to draft so it can be changed, and review forms whose template names no approvers. See Forms. |
| Delete | Delete them. |
An area shows only the actions it has, so a level that would add nothing there is not offered.
The areas are Models, Markers, Issues, Forms, Form templates and Element statuses. Each level includes the ones below it. Views and search sets have no area of their own: they follow Models. What each level allows is listed on each area's page, for example Markers.
The five starting profiles:
| Profile | Models | Markers | Issues | Forms | Form templates | Element statuses |
|---|---|---|---|---|---|---|
| Manager | Full control | Full control | Full control | Full control | Full control | Full control |
| Contributor | View | Edit | Edit | Full control | View | Edit |
| Field | View | View | Create | Edit | View | Edit |
| Partner | View | View | Edit | Edit | View | Edit |
| Viewer | View | View | View | View | View | View |
Partner is also set to Own company only. You can rename, change or archive any of them.
Create or change a profile
Archive a profile
Profiles are never deleted, only archived. Open the profile and choose Archive profile. People assigned to it lose every content right until another profile is assigned, but they keep pointing at it — Restore profile gives their rights back. An archived profile cannot be edited until you restore it.
Security
Security has the organization's sign-in policy and its single sign-on. It is for owners and security admins; admins do not see it.
Require two-factor authentication
Turn on Require two-factor authentication. From then on, members without a second factor cannot open this organization or any of its projects. Instead of an error they see a screen telling them to set one up, with a Set up two-factor button. Their other organizations are unaffected.
While it is off, the page says how many members it would lock out.
Single sign-on
You can connect one OpenID Connect identity provider. Members whose email is on its verified domain sign in through it instead of with a password.
A provider does nothing until its domain is verified. That check is what stops anyone from claiming a domain they do not own.
To rotate the credentials, use Replace credentials rather than removing the provider: it keeps the domain verification. People who sign in through the provider for the first time join as members.
If you remove the provider, people on that domain go back to signing in with a password. Anyone without one needs a reset link.
Storage
Storage is for owners and security admins. By default, project files are kept on platform storage. In Storage you can connect your own S3-compatible bucket (AWS S3, or a service such as Cloudflare R2 or MinIO) so new model uploads go there instead. Avatars and logos stay on platform storage.
Connect a bucket
The secret is stored encrypted and never shown again.
What changes do to your files
- Connecting sends new uploads to your bucket. Earlier files stay on platform storage and keep working.
- Change keys (same bucket, new credentials) touches nothing. Files stay available.
- Edit to change the bucket, endpoint or prefix: existing files are looked up in the new location and stay unavailable until you copy them there yourself. Nothing is moved for you.
- Disconnect sends new uploads to platform storage again. Files in your bucket stay there but are unavailable in the app until the same bucket is connected again.
If a call to your bucket fails, the page shows Last failure with the time and the error. Members only see a failed upload, so check here first.
Every owner and security admin gets an email whenever storage is connected, changed, re-keyed or disconnected, saying who did it and when — so a change nobody expected gets noticed.
Settings
Settings holds the organization's name, slug and logo.
- Name and Slug: edit them and choose Save changes. The slug is the organization's address and must be unique across all organizations; lowercase letters, numbers and dashes.
- Logo: PNG, JPEG or WebP, up to 2 MB. It is saved as soon as you pick a file.
Delete the organization
Only an owner can do this. Choose Delete organization and confirm. Every member loses access to it and its projects at once, and pending invitations are canceled. For 30 days a platform admin can restore it, which also brings back the invitations that have not expired by then. After that it is deleted for good, with every file in it.
Projects
Projects lists every project in the organization, deleted ones included for 30 days so you can restore them. Create one with New project. Project creators create theirs from New project on their home page. See Projects.
Good to know
- Expired invitations stay listed in Members under Invited until you resend or cancel them.
- Turning on the two-factor requirement shuts people out right away — check Account hygiene on Insights first.
- Personal API keys can read an organization and its project list, but cannot manage members, profiles, companies, security, storage or settings. See API keys.
- Everything on these pages is also available through the API: Organizations, Organization members, Companies, Profiles and Organization settings.
Related pages
Dashboards and widgets
Build your own charts, numbers and lists from the platform's metrics, and arrange them on your home page, a project, an organization or the admin panel.
Projects
Create projects, decide who works on them and with what rights, set up their notifications and GPS, follow what happens in them, and download exports.