Settings

Overview

The Settings section centralizes all controls for your organization and your personal account. Here you can manage your organization’s profile, members, roles, billing, integrations, and account details.

Settings

Here you can configure your Organization Logo, Name, Slug, and retrieve your Organization UUID.

• Logo: Use a square image (minimum 200×200px) that works well in both light and dark themes. PNG or SVG is recommended.
• Name: Displayed across all modules and reports.
• Slug: A unique, URL-safe identifier automatically generated from the name. Used in links and references.
• UUID: The immutable identifier for your organization. Useful when contacting support or for integrations.

You can create multiple organizations. Each requires its own subscription. You are automatically assigned the Owner role in new organizations you create.

On-Premise Option

For unlimited organizations and advanced infrastructure control, see our On-Premise solution.

Ownership

Ownership can be transferred to another member. The process is instant and can only be undone by the new Owner. This is useful for handovers or restructuring.

Deletion

Deleting an organization is permanent. All data (policies, risks, assets, frameworks, etc.) will be irreversibly removed.

Deleting an Organization

Deletion starts immediately once the organization name is confirmed. There is no second confirmation step. Only the Owner can delete an organization.

Branding

Apply your own brand to the surfaces your vendors see: external vendor questionnaire pages and PDF reports pick up your logo and colors. devguard itself stays devguard-branded, so the app you work in always looks the same. Branding is available on the Business plan. On the free plan the section is visible but disabled.

• Full logo: A wide wordmark that replaces the devguard logo in the header of external pages. Upload a wide PNG with a transparent background; the image is automatically resized to fit within 640×80px.
• Primary color: Used for buttons, links, and highlights on external pages, and as the accent color in PDF reports. Colors must be 6-digit hex values with a contrast ratio of at least 3:1 against white, so white text stays readable on them.
• Secondary color: Used for decorative elements, for example cover art in PDF reports. The same contrast rule applies.
• Company description: A short text (up to 500 characters) shown to vendors in the footer of external pages.
• Company links: Up to 5 links (label plus https:// URL) shown next to the description on external pages.

Changes are saved automatically as you edit. Clearing a field removes that part of the branding immediately.

Vendor questionnaires

External questionnaire pages show the branding as it was when the invitation was sent. If you change your branding afterwards, resend the invitation to update it for the vendor.

Members

Organizations work best with multiple members collaborating toward compliance goals.

Invitations

1. Invite members via email.
2. Invited users receive a link to join.
3. Invitations can be revoked or resent before acceptance.
4. Pending invitations are listed beneath the member list.

Account Creation

Invitees must create an account before joining. Once their account is created, they will see pending invitations on their dashboard.

Member Types

• Owner: Full control, including billing, member management, and organization deletion.
• Admin: Manage policies, risks, frameworks, and members. Cannot transfer or delete ownership.
• Member: Limited access. Can collaborate on content but cannot change organizational settings.
• Auditor (coming soon): Read-only access for reviews and external auditors.

Roles

Roles represent business functions and can be assigned to multiple members. Unlike member types, roles do not grant permissions. They are used to group members and attach responsibilities to objects such as Assets, Risks, or Policies.

Examples

• CEO: Single user linked to executive responsibilities.
• Developers: Group of technical staff involved with risk and asset management.
• Managers: Leadership group, which may include the CEO and other department leads.
• Team: A collective group where all users are included.

We recommend creating roles per department or function (e.g., Sales, Marketing, Legal) to reflect your organizational structure.

Deleting Roles

Deleting a role removes its associations across all linked objects. Carefully review dependencies before deletion.

Billing

Billing is managed at the organization level. Each organization has one subscription, independent of the number of users.

• Plans are billed monthly or annually.
• The annual plan provides a ~20% discount (two months free).
• You can cancel anytime via the interface. The subscription remains active until the end of the billing cycle.
• Canceled plans are not refunded.

For details see our Pricing page.

SAML Integration

We support SAML Single Sign-On (SSO) so users can authenticate with your existing Identity Provider (IdP).

This integration requires exchanging configuration information about your identity provider, such as the URL and the certificate. Once we have this information, we will configure the integration for you.

Annual Plan

SAML SSO is available on the annual plan, which also includes a ~20% discount.

On-Premise Integration

We offer an On-Premise deployment to run devguard in a selected AWS region or within your own infrastructure.

This allows:

• Unlimited organizations under one license.
• Dedicated hosting for regulatory or residency requirements.
• Greater control of data and system integration.

Infrastructure Requirements

Minimum Requirements

• Support for Docker images
• Ability to whitelist authentication and framework endpoints
• Availability of PostgreSQL, Redis, and a message broker

Costs depend on the chosen environment:

• AWS: Billed per instance and region.
• Self-hosted: Based on your hardware and the level of setup and support required.

Notifications

Control what devguard tells you about, and how. Preferences live on one screen and apply to your account across every organization you belong to.

Every notification is a category delivered over one or two channels: in-app, email, or both. The two channels are independent, so you can keep something loud in-app and silent by email, or the reverse. Turning one off never affects the other.

In-app

In-app notifications appear in the bell in the top bar. It shows an unread count, and opening it reveals your inbox, a list of recent items split into Unread and All. Selecting an item marks it read and takes you straight to what it is about: the policy, the review, or the deadline. The same feed is surfaced on your dashboard, so you can triage without leaving what you are doing.

This is the quiet, always-there channel. Nothing lands in your mailbox; the unread count simply updates the next time the app loads. In-app is on by default for every category that supports it, because the inbox is where you look to see what has happened without being interrupted.

Email

Email notifications are sent to your account email address. This is the channel that reaches you when you are not in devguard, which matters for time-sensitive things like an overdue review. For most categories you choose the cadence:

• Instant: one email per event, sent as it happens. Best for things you may need to act on the same day. It is the default.
• Weekly digest: events are held back and arrive together in one email at 07:00 UTC on the day you pick. The hour is fixed rather than local, so far enough west it can reach you late on the previous evening. Choosing weekly reveals a day selector next to the cadence; the digest goes out that morning, grouped into a section per category, so a week of policy approvals and due dates is one email rather than a dozen. Nothing is dropped along the way: an event queued after the send time simply waits for the following week. Keep a category on instant if you need same-day notice.

One thing to know about the weekly cadence: an event's place in a digest is fixed when the event happens, not when the email goes out. A change you make here therefore applies to what happens after it. A digest that is already scheduled still arrives on its original day, carrying the items it had collected by then, so turning a category off, moving it back to instant, or picking a different day all take effect from the next event onward rather than emptying the digest already in flight.

Marketing email is email-only by nature and has no in-app equivalent. System emails, such as password resets and email changes, always send regardless of your other settings.

How the two work together

Because the channels are separate, a common setup is in-app for everything, email only for the categories you must not miss (for example, deadlines). Set this per category on the Notifications settings screen: toggle in-app and email independently, and where a cadence selector is offered, choose instant for what you must act on the same day and weekly for the rest.

Categories

• Deadlines: reviews, assessments, remediation and assignments that are due or overdue. You are notified at set lead times (ahead of the date, a day out, and once overdue) and never twice for the same point, so a busy period does not bury you in repeats. The first lead is a week for most items; for policy and training assignments it follows the cadence instead, stretching to a month ahead of a yearly one.
• Assignments & mentions: when you are made responsible for something, or an object you own is referenced elsewhere.
• Policies: approvals and new versions of policies you own or approve.
• Updates to your items: when someone changes the status or key details of an item you own or oversee.
• Marketing: optional product updates and surveys.
• System: account notifications such as email changes and password resets. Always on and cannot be disabled.

Defaults

In-app notifications are on by default, so your inbox is never empty of things you are entitled to see. Email is on and instant for the actionable categories, so nothing waits a week unless you ask it to.

Account

Manage your personal account details and preferences.

Profile

Update your Avatar, Name, Email, and Password. You can also choose your preferred theme (light/dark) and language.

Notifications

Notification preferences now live on their own Notifications page. Open it from Settings → Notifications, or via the shortcut on your account screen.

Expert Mode

Enable Expert Mode to display additional object information such as UUID, creation date, and last updated date. This is useful for debugging, data exports, and imports.

Deleting an Account

Account deletion is irreversible. You must transfer or delete ownership of all organizations before deleting your account.

Two Factor Authentication

Enable Two Factor Authentication to add an extra layer of security to your account. This requires you to enter a code sent to your phone or email every time you log in.

Tokens

API tokens let a script or tool authenticate against the devguard API without a browser session. They live under Tokens, which documents creating and revoking them, what a token is allowed to do, the rate limits and the response codes in one place.

Whatever you build with one, the rules are the same: store it as a masked secret, never commit it, use the shortest expiry the job tolerates, and delete it the moment it is exposed or unused.

About

The About section provides transparency into the application:

• Current version and release details
• Company details and contact information
• Quick access to documentation and support channels

This helps you stay informed about the state of the platform and reach us when needed.