Organisation: profile, members, billing, security and data

Organisation (under Configure) holds everything that is configured once for the workspace. Which tabs a person sees depends on their role — an Org admin sees them all; a member sees their own.

Organisation

• Organisation profile — legal name, country, address, contact email, organisation type, legal form, registration number, website and size band. These values pre-fill the provider identity block on the EU declaration of conformity and the Annex VIII registration sheet, so fill them in early. The contact email and country are what mark the profile complete on the first-run checklist.
• Members & roles — invite people, set their role, reset a password, remove a member; and the roles themselves — the built-in set, custom roles, per-permission editing. See Invite your team and assign owners.
• AI literacy — your own Art. 4 standing: the answers you gave, the programmes assigned, and when your record lapses. The team view lives on AI Literacy.
• Billing & plan — the plan, its caps, and the usage meter. During the free public beta it says there is nothing to pay and no card on file, and shows what the workspace is using against its caps; see Plans, billing and upgrades.

Security & access

• SSO & SCIM — OIDC single sign-on and directory provisioning, from the Manage plan. See Set up SSO and SCIM provisioning.
• Security — two-factor authentication, the password policy, and session controls. Every account must set up two-factor authentication from its second sign-in (the first is left free for onboarding), and it is enforced on every sign-in once set up. Switch on Require two-factor from the first sign-in to remove that first free sign-in for your members. When someone loses or replaces their phone, an administrator resets their two-factor authentication in the same tab, under Reset two-factor authentication: the member's authenticator and backup codes stop working, they are signed out everywhere and emailed, and their next sign-in goes straight to setting up an authenticator again, with no free sign-in first. Only members who have set up an authenticator can be reset. You confirm each reset with your own password and, once you have set one up, a code from your own authenticator. You can reset your own the same way; you are signed out at once. A guest who joined from another organisation is reset by their own organisation.

Data & platform

• Data, privacy & residency — where your data is held (application and database on Hetzner in Nuremberg; Aria on Mistral in Paris under a commercial agreement with no training on your data), a residency statement you can show your team and put in your DPA, a data export, and workspace deletion.
• API keys & webhooks — scoped ak_ keys for the machine API and the MCP server, and outbound webhook endpoints. See Machine API and the MCP server.
• Integrations — a directory of what connects and where it is set up: the four read-only OAuth evidence connectors (Drive, SharePoint, GitHub, Jira) point to Evidence → Connectors, where they are connected; the identity providers point to SSO & SCIM; the task-management integrations are marked as planned.
• Notifications — which channels and which events notify you.
• Advanced — Regenerate obligations, which re-runs the rules engine over every system. Admin only; you will rarely need it.

Compliance

• Frameworks — the law you are run against (the EU AI Act and the GDPR, always in scope) and the standards you switch on (ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF), each with its scope statement and target date. Any member can read it; an org admin switches. See Frameworks: the law you run against, and the standards you switch on.
• My acknowledgements — the disclaimers and declarations you have accepted (the working-draft acknowledgement on first export, Aria's disclaimer), with dates.

Account

• Referrals — invite peers to Veritome.

Where the audit log went

The audit trail was a Settings tab; it is now a screen of its own under Prove it — Audit trail — with the integrity banner and the CSV export on it.