Account & Organizations

Your Palmata account is separate from your organization memberships. You can belong to multiple organizations or have no memberships. Reports belong to the organization. This page covers who can do what, how people join, and the settings that are yours and yours only.

Opening a report in another organization

If a report link belongs to another organization you can access, Palmata shows that organization’s name and a Switch to [organization name] button. Click it to change your active organization and open the report at the same link. Choose Back to reports to stay in your current organization.

You only see this option when you have access to the report. Reports in organizations you can’t access, and private reports you can’t view, remain unavailable.

Switch organizations

Open your account menu and choose Select Organization to change your active organization. Organizations where you inherit admin access are available here, including nested sub-organizations. If the destination requires MFA, complete its verification or enrollment after switching to access its reports and settings.

Each open tab keeps its selected organization. Switching in one tab leaves other open tabs on their current organization, including after a reload. A new tab with no saved selection starts with your most recently selected organization.

Roles

Everyone in an organization has one of four roles. The role decides what they can do.

• Owner — the organization’s top authority. Can do everything an admin can, plus manage admins. There’s one owner.
• Admin — runs the organization day to day: invites and removes people, changes roles, approves report requests, and manages billing.
• Creator — builds reports directly. The working role for anyone doing audits.
• Member — can view shared reports and request a report, but can’t build one without an admin’s sign-off.

The split that matters most in daily use is creator vs. member. Creators can open New Report and configure the audit. Members can configure the audit and submit it when member report requests are allowed. A creator submits it with Build report; a member uses Request report to send the same setup to the admins — see Report requests below.

Organizations workspace

Everyone with an organization membership can open Organizations from the sidebar. Members and creators see Members for their organization; creators also see their own credit usage there. Owners and admins can browse the hierarchy and manage people, reports, requests, credits, and settings for a selected organization.

Choose what to manage

Open the dropdown below Organization scope at the top of an organization page. Click an organization name to view it, or check several organizations to view them together. Use the arrows to expand or collapse branches, and Search organizations to find a name or path. Long trees scroll inside the dropdown. Click Done to close it.

The scope selector stays visible above the content while you scroll and move between organization sections. The summary below the dropdown lists the selected organizations; long lists end with an ellipsis. Hover over the summary to read the full list. Members and creators stay on Members for their organization; links to other organization sections return them to Members.

Check several organizations to manage their members, reports, and report requests together. Include descendants adds the nested organizations under your selection. Checked selections remain when you search for another organization.

Selecting an organization in the tree does not change your active organization for reports. Parent owners and admins inherit admin access to descendants by default, including reports, settings, report requests, and credits, without joining each one. A sub-organization can turn off inheritance through its branch; explicit memberships remain. A child administrator’s tree starts at their organization and includes its descendants.

Owners and admins choose sections from the sidebar in this order: Members, Reports, Report Requests, Credits or Billing & Credits, MCP, API when enabled, and Settings. Members contains People, Invitations, and, for top-level owners and admins, Access requests. Reports and Report Requests show the selected scope in one combined list with organization labels. Select one organization to manage credits, MCP settings, API keys, or organization settings.

Default report visibility

In Settings → Organization preferences, owners and admins can turn on Share new reports by default to share new reports with the organization. It is off by default, so new reports are private. The setting follows the parent organization unless you override it. Existing reports and reruns keep their sharing settings. Choose Use parent or Use default to remove an override.

Sub-processor notifications

In Settings → Organization preferences, owners and admins can turn on Subscribe to notifications about changes to sub-processors to subscribe all owners and admins in the selected organization. This is the last toggle in the block and is off by default. Turn it off to unsubscribe the organization.

Manage people across organizations

People lists each person once. The Memberships column shows each organization and the person’s role underneath it; scroll horizontally to see more memberships. Search people by name or email.

To invite existing members to other organizations:

1. Select the people to invite.
2. Click Add to organizations.
3. Search the destination list and check the organizations. Searching again preserves your selections.
4. Choose a role and click Start invitations.

Membership starts after each person accepts. Existing memberships and pending invitations are skipped.

Use Change roles or Remove memberships to act on selected people’s memberships within the current scope. Owners and your own membership are protected. Removal ends access to that organization and its reports.

Bulk actions show a progress notification while you continue browsing, followed by completed, skipped, and failed counts. Expand Failure details if any items fail. Keep the browser tab open until the action finishes.

Verify email and reset MFA

Select one organization and open Members → People. With direct or inherited owner or admin access, you can manage verification, MFA, and creator spend limits on that organization’s member rows.

• Verify appears for an unverified person whose email domain matches the selected organization’s domain. Click it to mark their email as verified.
• When MFA is enabled and another person has an authenticator or passkey enrolled, open their ⋮ menu and choose Reset MFA, then confirm. This removes their authenticator and all passkeys; they’ll be prompted to enroll again on their next sign-in. The menu is hidden when there’s no MFA enrollment to reset.

Creator spending limits

In a creator’s row, Credits shows their spending and limit for the selected period, or No spend limit. Owners and admins can set limits for other creators.

Click Set limit or Edit limit, enter a positive credit amount, choose a daily, weekly, monthly, or annual period, then click Save. To clear an existing limit, click Edit limit, then Remove.

Invite new people

Click Invite people, enter email addresses separated by commas or new lines, choose the destination organizations and role, then click Start invitations.

Send email invitation is selected by default. Clear it to create the invitations without sending email. Either way, the invitations appear in the recipient’s account for them to accept. See Signing in.

Members → Invitations lists pending offers in your selected scope. Revoke prevents an invitation from being accepted.

When organization administration is not enabled, admins invite a co-worker from the Members page instead. Co-worker invitations offer the member role. Send email invitation is selected by default; clear it to create the membership or invitation without sending email.

Review access requests

When automatic joining is turned off, verified signups with a matching email domain go to the organization’s access requests by default. Owners and admins receive an email for each new request. You do not need to enable the Organizations workspace or configure a separate approval policy. An explicit invitation-only policy still prevents domain requests. A matching domain alone does not grant membership.

Open Access requests at the top-level organization. In the Organizations workspace, open Members → Access requests. Search requests by name or email; the same search also filters previous decisions.

For each person, open the organization selector, search and check the active organizations to invite them to, and choose a role beside each selected organization. The dropdown scrolls within a bounded area, so request cards stay compact even in large families. Search preserves selections and roles. Click Done, then Approve invitations.

Approval creates invitations. The person chooses which to accept. Decline closes the request without granting access. Previous decisions remain listed below pending requests.

Browse and duplicate reports

Select organizations and open Reports to browse one combined list with shared search, sorting, filters, and report-card actions. Each card shows its organization. Include descendants adds reports from nested organizations. Selecting an organization in the tree keeps your active organization unchanged. Opening a report in another organization switches your active organization to it.

To copy a completed report to another organization, open its card menu and select Duplicate. Choose an active Destination organization, select the versions to copy, then click Start duplication. All available versions are selected initially. You need permission to copy from the source and into the destination organization.

Each copy keeps its name, description, steering instructions, saved report plan, and completed results. Selected versions stay linked for comparison. Copying uses no credits and makes the reports shared in the destination organization. Automatic rerun schedules are not copied.

Report requests

When a member requests a report, it appears in Report Requests when its organization is in your selected scope. Requests appear in one list with their organization beside each request. Search filters requests across all selected organizations, including descendants when enabled. An owner or admin approves it to start the build and spend report credits, or declines it without building. The requester is notified when the request is approved and the report begins building.

Authorized platform staff can also review requests in Management → Reports or Management → Organizations → [organization] → Reports. Open a pending report’s ⋮ menu and choose Approve or Deny. Approval shows the credit cost before starting the build. Denial accepts an optional reason and notifies the requester.

In either Management report list, choose Activity from a report’s ⋮ menu to see who changed it and when. The Viewers tab shows recorded report viewers. These actions require staff permission and access to the report’s organization.

Owners and admins can turn off Settings → Organization preferences → Allow members to request reports. It follows the parent organization, or is enabled by default for a top-level organization. When disabled, members can still configure a report. Submitting it shows “This organization does not allow members to request reports.” Owners, admins, and creators can still build reports. Existing requests remain available for review.

Billing & Credits

Billing & Credits appears for organizations that have not purchased an Enterprise license, including those with an existing paid subscription. Owners and admins also see Transaction History. Enterprise and Internal organizations show Credits, without transaction history. The label follows the organization you select. See Billing & Credits for subscriptions and purchasing permissions.

Create and maintain the hierarchy

Select an organization and click Create sub-org in the page header to add a child beneath it. Sub-organizations can have their own nested organizations.

In Settings, use Rename, Change parent, Archive, or Restore. Changing the parent moves the whole subtree within the same family. You need administrative authority over both the old and new parents. Members and reports stay in their organizations; administrative authority follows the new hierarchy. A root organization cannot be moved or archived here.

The destination picker supports search and scrolls within the modal. It excludes destinations that would create a cycle.

Archive active descendants before archiving their parent; restore ancestors before restoring a child. Active report jobs and billing can block archival. Archival disables schedules and revokes pending invitations. Restoring an organization does not restart its schedules.

Settings → Organization preferences → Inherit admin access from parent organizations follows the parent’s configuration unless overridden. Palmata’s default enables it. Turning it off stops access inherited from ancestors through that branch, including your own access if it is inherited. Explicit memberships remain, and admins within the branch can still inherit access in its descendants. Turning inheritance back on requires an admin who still has access to that organization.

Configurations and overrides

Configurations follow the parent organization by default, including feature controls, report defaults, member invitations, report requests, MFA policies, and admin-access settings. Inheritance follows the full hierarchy: a change to an ancestor reaches descendants that have no local override. A top-level organization follows Palmata defaults.

Settings show Inherited, Default, or Override beside the label. Changing a value creates an override for that organization. Choose Use parent or Use default to remove an override and follow its source again. An explicit override stays in place when the parent changes, even if it currently has the same value as the parent.

In Settings, open the ⋮ menu beside Configurations and choose Reset configurations. The dialog names the parent whose configurations will apply, or explains that a top-level organization returns to Palmata defaults. Confirm Reset configurations to remove the overrides for settings you can manage. Staff-controlled feature overrides require a staff reset.

Authorized staff can also choose Reset configurations from an organization’s ⋮ menu in Management → Organizations to reset its feature controls and configuration overrides. Child organizations retain their own overrides. Changes appear for connected clients without refreshing.

Name, domain, Public API Access, API credentials and key limits, billing and credit configuration, plans, credit balances, reports, and explicit memberships stay specific to each organization. Changing the parent changes the source of inherited configurations while keeping local overrides.

Management organization changes

A staff assignment applies to the assigned organization and every sub-organization beneath it, at any depth. Your staff permissions still determine which actions you can take. The customer Inherit admin access from parent organizations setting does not restrict staff assignments. Removing an assignment ends access through that assignment; moving a sub-organization makes staff access follow its new ancestry.

Platform staff with the required permissions can open Management → Organizations, select an organization or sub-organization, and open the ⋮ menu beside the organization name.

When a Management form offers Send email invitation, select Send onboarding email to send the guided welcome with account setup, Palmata’s core uses, and links to Getting Started and Brand Perception. Leave Send onboarding email clear to send the standard invitation. The onboarding option is available only when an organization is selected and an email invitation will be sent. The same choice applies to individual user creation, adding a member, bulk user creation, and bulk organization imports.

• Convert to Enterprise lets you edit the organization name and choose which existing members remain. All current members are selected initially. Search the scrollable list and clear anyone who should lose their membership. Parent members are not listed. Conversion sets the Enterprise plan and detaches the organization from its parent, if it has one. Reports and sub-organizations stay in place. Any existing subscription stops renewing at the end of its current billing period.
• Change parent moves the organization and its sub-organizations beneath another active organization, including one in a different family. Search the destination list and select the new parent, or choose None to detach it. Detaching preserves its plan, direct memberships, and reports. Destinations that would create a cycle are excluded.

Detaching ends access inherited from the previous parent. Reparenting follows the new hierarchy’s admin inheritance settings. Staff need permission to manage the organization and both its current and new parents. Other connected clients receive the changes automatically.

Approved MCP callback domains

Owners and admins can approve additional MCP client callback domains in the organization’s MCP page under Approved MCP callback domains. Enter the exact hostname, click Approve domain, then select Trust and approve only if you trust whoever controls the domain. Approval covers HTTPS callback paths on that hostname; subdomains need separate approval. See Connect your tools.

These approvals apply only to the selected organization and are not inherited by parents or children. Connections that depend on an organization approval can access only that organization, even if you belong to others. Domains marked (built in) stay in the list. Clear their Enabled checkbox and confirm Disable domain to block new and existing connections using that domain in this organization. Select the checkbox and confirm Enable domain to allow its original callbacks again. Other organizations keep their approvals.

Additional domains have a Remove action. Confirm Remove domain to revoke that approval; you can approve the hostname again using the input below the list. Admins see changes without refreshing the page.

API keys

When Public API Access and organization administration are enabled for your organization, owners and admins manage integration credentials in API → Create API Keys. Select Create API key, enter a name, choose access scopes and an expiration, then select Create key. Copy the key before closing the dialog; it is shown only once. Keep it in your server’s secret manager. Open API Documentation within the API tab for authentication examples and the operation reference.

Use Edit access to change a key’s name or scopes. Remove every scope to suspend access, or select Revoke to end access permanently. Changes apply to subsequent requests; accepted work and scheduled runs can continue. Platform staff set the API key limit in Management. It defaults to 100 usable keys. Lowering it keeps existing keys active, and 0 stops new keys. Connected administrators see changes without refreshing. Disabling Public API Access blocks subsequent key requests and hides key management for that organization; accepted work and scheduled runs can continue.

Each key belongs to the selected organization and uses the scopes you grant. reports:read covers shared reports and reports created by that key; other private reports require reports:read-private. reports:request submits a report for admin approval without starting generation or spending credits. Keys cannot access staff diagnostics or administer accounts, members, or other keys.

Request an investigation

In an internal organization, select Request Investigation in the sidebar. Describe what needs investigating, what you expected, and any useful context. You can attach screenshots. Select Submit Request to save the request for staff review and send it to the team’s investigation Slack channel. The current page and report, when open, are included automatically.

If Slack delivery fails, the confirmation shows that your request was saved and provides a request ID to share with the team.

Authorized staff select Claim in the Slack message to take ownership. The claimant selects Done, enters what was found or fixed, and selects Mark Done. The message updates to show completion, and the requester receives an email with the resolution and a report link when included. Staff can review ownership, resolution, and email delivery status in All Feedback.

Account settings

Your account settings are separate from the organization and apply only to you. Open them from your account menu.

• Name — edit the display name others see on your invites and activity.
• Password — select Set password to send an OTP to your account email. Enter the OTP and your new password in the modal. Because you’re already signed in, this entry point doesn’t require Turnstile. The OTP can add a password to an account that previously used Google only or replace an existing password.
• Staff report tabs — staff with access to Performance and Logs can turn off Show Performance and Logs to hide both tabs for demos. The preference is saved across organizations. Turn it back on to restore the tabs.

• Notifications — toggle the email notifications you receive (report finished, request approved, and similar). Turn off anything you don’t want.
• Auto-accept invitations — enabled by default in account settings. Invitations automatically add you to the inviting organization once your email is verified. Enabling it also accepts valid pending invitations. Turn it off to review invitations before joining.
• Organizations — expand this collapsed section to review all your memberships and pending invitations. Accept or decline invitations, hide or show an organization in the switcher, or leave it. Hiding preserves membership and report access; hidden organizations remain listed here so you can show them again. Inherited admin access is labeled and has no Leave action; change the organization’s inheritance setting or the parent membership instead. Leaving a direct membership requires a new invitation to rejoin; inherited admin access may still apply. An owner must transfer ownership before leaving.
• Pre-approved login — when enabled for your account, select Create login key, enter a key name, and copy the key before closing the dialog. Send it as X-Pre-Approved with your email and password to skip interactive Turnstile verification during password sign-in. Password and two-factor requirements still apply. Select Revoke to stop using a key. Your current Organization ID appears below the login-key controls with a copy button. These keys belong to your account; organization API credentials are managed separately under API.
• Delete account — permanently remove your account. You’ll confirm with your password. This is irreversible.

Signing in

Palmata reconnects automatically if your session check is interrupted. If your session has expired, Palmata takes you to sign-in.

Palmata accounts use email and password. A few details worth knowing:

• Email verification — new accounts confirm their email with a one-time verification code before the account is active.
• Two-factor authentication — if your account has 2FA enabled, you’ll enter a code from your authenticator app after your password.
• Forgot password — request a reset link from the login screen; it emails you a link to set a new one.

After verification or sign-in, an account without memberships opens Welcome to Palmata. With Auto-accept invitations enabled, valid invitations are accepted automatically after email verification. If you turn it off, pending invitations appear with Join and Decline buttons. Existing members can review invitations in account settings regardless of the current organization’s administration settings. If access is awaiting approval, the page names each requested organization and explains that an organization administrator must approve the request. Use Refresh to check for approved invitations. If your email domain matches an active organization with automatic joining turned off, your verified signup goes to that organization’s admins for approval by default. Invitation-only policies still explain that you need an invitation; that message does not mean a request has been submitted. If there is no matching organization or invitation, support and sign-out remain available. Leaving your final organization returns to this account screen.

Some organizations restrict signups to specific email domains. When public signup is disabled, a signup request can still require staff review before an account is created.