# Organisations

Create an organisation, invite members, set roles and brand the pages your guests see.

An **organisation** is your company or team inside Databeamer. It owns [groups](https://databeamer.eu/en/docs/groups/groups), has its own storage and limits, and decides how pages for outside guests look. Organisations are available on plans that include them; if yours does not, **Create organization** will say so.

## Creating one

Choose **New Organization** from the **New** menu, or **Create an organization** on the dashboard. Give it a name; the slug becomes part of its web address. You become the organisation's **Owner**.

## Members and roles

Under **Settings › Members**, **Add member** invites a Databeamer user. Each member has a role:

| Role       | Can                                                                                                 |
| ---------- | --------------------------------------------------------------------------------------------------- |
| **Owner**  | Everything, including deleting the organisation, managing single sign-on and changing other owners. |
| **Admin**  | Manage members, groups and settings.                                                                |
| **Member** | Use the organisation's groups they belong to.                                                       |

**Change role** and **Remove member** are in each member's menu. If single sign-on is enabled, new SSO users appear under **Pending SSO members** until an admin chooses **Approve**.

## Settings

- **General**: name, slug and logo.
- **Guest pages**: the wallpaper and background gradient shown to guests who open your transfers, requests and secure mails. Groups and individual requests can override it.
- **Groups**: every group in the organisation, with **Show groups pending removal** for ones that are being deleted.
- **Document types** and **Group types**: classifications with states and labels that your organisation uses. These labels are visible to the server, unlike file contents, so keep them free of sensitive details.
- **Single sign-on** (owner only, where your plan includes it): connect your identity provider over OpenID Connect or SAML 2.0, and optionally disable password login.

> **Security details**
>
> - Sign-in is federated through Databeamer's identity service (Zitadel), which holds the identity-provider secrets; Databeamer's own servers never see them. Signing in grants no keys: a new SSO user stays **Pending** until an admin's device wraps the organisation's key versions to their exchange public key with ECIES. A compromised identity provider alone therefore yields no plaintext.
> - Enforcing SSO-only changes how people log in, not how data is protected; recovery still works through the recovery phrase.
> - The organisation's name, slug, logo, member list, roles and membership labels are plaintext on the server, as is guest-page branding.

- **Shared mailboxes**: where Secure Mail is enabled for the organisation.
- **Usage**: storage, seats, upload history, transfers sent and active requests, overall and per group.

## Your memberships

**Settings › Organizations** in your personal settings lists every organisation you belong to and your role in each.