User Roles & Permissions

Overview

Concord has four roles you can assign to people in your organization. You set a person's role when you invite them under Settings → Users (Owners and Admins can invite).

• Owner — Full access to everything, including billing. Owners can view and update the organization's billing details (billing address, payment method, invoices, plan, and add-ons) and can add or remove other Owners. The person who first sets up an organization is its Owner, and every organization must always have at least one. If an organization is ever suspended over a billing issue, only an Owner can resolve it.
• Admin — The same access as an Owner, with one exception: billing. Admins manage users, settings, and every product area, but cannot view or change billing details.
• Limited — A contributor role for people who work in Concord day to day without managing configuration. A Limited user can view the dashboards and the work assigned to them, handle privacy requests (DSARs), complete tasks, and add evidence to controls. They cannot change consent configuration, deployment, branding, framework setup, or organization settings.
• Auditor — A scoped, read-only role for external auditors. An Auditor has no standing access on their own. You grant them time-boxed access to specific frameworks through the Auditor Portal, and that grant is the only thing they can see.

What a Limited user can reach depends on which products your organization uses: in a privacy-focused organization they act as a privacy contributor, and in one using Concord Trust's compliance tools they act as a controls contributor. Owners and Admins always have full access across every product your organization has enabled.