A company can have several people handling its programs. Each one has their own account, signs in with their own password and two-factor authentication, and everything they do is recorded under their name in the audit log. Nobody needs to share the company account.
| Role | What they can do |
|---|---|
| Company account | Everything. It is the account that signed up, and the only one that signs the company agreement. |
| Administrator | Everything the company account can do: programs, rewards, payments, integrations and the team. |
| Triager | Handles reports: comments, status, severity, internal notes and saved replies. No payments or program settings. |
| Read-only | Sees programs and reports, changes nothing. |
The email must not belong to an existing RootBounty account: an account has one role for good, so a researcher account cannot join a company team. Use a different address. If the link expires before they use it, send the invitation again from the same page.
A team can have up to 25 people.
On Settings → Team, change anyone's role from the list; it applies at once. Remove ends their access immediately: their account stops working and every device they used is signed out. What they wrote — comments, notes, status changes — stays on the reports.