Skip to main content
User management is in Settings → Users. Inviting and editing users requires Admin access. From here you can invite new users, change roles, configure default subscribers, and manage service accounts for API access.

​
Inviting users

1

Go to Settings → Users

Click Add User.
2

Enter the user's details and role

Enter the user’s name and email, check Invite to VISO TRUST, and select their role: Admin, Program Manager, Contributor, or Viewer. See Role-Based Access for a breakdown of what each role can do.
3

Send the invitation

The user receives an email with a link to set up their account. If SSO is configured, their first login must go through your SAML identity provider. Social logins (Google, Microsoft) work after the first successful SSO login.

​
The users table

Settings → Users lists every user with their business unit, role, and Status, along with a Last active date. Each row also shows the user’s workload: Subscriptions, Business owner assignments, and Assessment lead assignments. VISO TRUST checks those assignment counts before it lets you remove someone.

​
Changing a user’s role

From Settings → Users, click the three-dot menu next to any user and select Edit. Update their role and click Save. Role changes take effect immediately.

​
Reassigning a user’s work

You don’t have to remove a user to hand off their relationships. Click the three-dot menu and select Reassign to move their subscriptions, Business Owner assignments, and Assessment Lead assignments to someone else. The option is unavailable when the user holds none of the three.

​
Removing a user

Click the three-dot menu next to the user and select Delete. If the user has relationship subscriptions, Business Owner assignments, or Assessment Lead assignments, the delete dialog prompts you to reassign them first. Select another user to receive the assignments, then click Reassign and Delete Contact. These counts include archived relationships, so a user may need reassignment even if they own nothing in your active portfolio. Removing a user:
  • Revokes their platform access immediately
  • Does not delete their past activity, comments, or audit trail entries

​
Users managed by your identity provider

When your organization syncs users from an identity provider, the IdP manages those accounts rather than VISO TRUST, and the menu next to them differs: To take away an IdP-managed user’s access from within VISO TRUST, select Deactivate instead of Delete. Their Status reads Active or Inactive rather than Pending invite, because there is no VISO TRUST invitation in the flow. Removing them from the application in your IdP is what revokes access at the source.
Deactivating a user does not reassign their relationships. Use Reassign first if they hold Business Owner, Assessment Lead, or subscription assignments.

​
Default subscribers

A Default Subscriber is automatically subscribed to every relationship in the organization, both existing and future. Use this for centralized risk or compliance teams that need visibility across the entire vendor portfolio. To enable:
  1. Click the three-dot menu next to the user → Edit
  2. Check Default Subscriber
  3. Click Save
The change is immediate: VISO TRUST adds the user as a subscriber to all current relationships and any new ones going forward.
A Default Subscriber cannot be removed from an individual relationship unless you first uncheck the Default Subscriber setting on their user profile.
You can configure multiple Default Subscribers. See Inviting Your Team for more context on how to use this feature.

​
Business Units

Every user belongs to a Business Unit, which is set when they’re created or edited. Business Units determine which unit a relationship is attributed to when the user is assigned as Business Owner. To manage Business Units, go to Settings → Business Units. See Business Units for details.

​
Service accounts for API access

If you’re using the VISO TRUST API for automation or integration, use a dedicated service account rather than a personal user account. This ensures API access isn’t tied to an individual’s employment status and makes it easier to manage token lifecycle. To create a service account:
  1. Invite a new user with a service account email (e.g., viso-api@yourorg.com)
  2. Assign the Admin or Program Manager role, because the API endpoints require program-level access
  3. Log in as that user to generate an API token from the user profile
See Authentication for API token generation and usage.

​
User activity and audit trail

The platform’s audit trail records all user actions that affect relationships, assessments, and settings. This includes who created a relationship, who uploaded an artifact, who accepted risk, and who changed a setting. The activity log for a relationship is visible in its Activity tab. Organization-level audit events are available to Admins and Program Managers through the API, without needing to ask support: Both take a start and end timestamp and return up to 500 records per request, so pull a narrower window if you hit the cap. POST /api/v1/audit-log/events also takes an eventTypes array; omit it to get every type. Events are grouped into four categories: The full list of accepted eventTypes values is on the endpoint’s page under API Reference → Audit Log. See Authentication for how to generate a token.