Roles and Permissions

Understand the four Matproof roles and how to invite team members and external auditors.

Overview

Matproof uses four roles to control what team members can see and do. Roles are assigned per user when they are invited and can be changed later by an Admin or Owner.

Role comparison

Permission	Owner	Admin	User	Auditor
View controls, evidence, policies, risks	Yes	Yes	Yes	Yes
Edit controls, evidence, policies, risks	Yes	Yes	Yes	No
Manage vendors	Yes	Yes	Yes	No
View integrations	Yes	Yes	No	No
Manage integrations	Yes	Yes	No	No
Invite / remove users	Yes	Yes	No	No
View and edit settings	Yes	Yes	No	No
Manage billing	Yes	No	No	No
Delete organization	Yes	No	No	No

Role descriptions

Owner

Full access to everything including billing and the ability to delete the organization. There is exactly one Owner per organization. Ownership can be transferred to another user in Settings → Team.

Use this role for the founder or the accountable executive sponsor of the compliance program.

Admin

Full access to all compliance features and team management. Admins can invite and remove users, manage integrations, and configure settings. They cannot touch billing or delete the organization.

Use this role for the compliance manager or IT security lead who runs the day-to-day compliance program.

User

Can view and edit all compliance content — controls, evidence, policies, risk register, and vendors. Cannot manage users, view integrations, or change settings.

User is the right role for most team members — engineers, department leads, and anyone who contributes to the compliance program without needing administrative access.

Auditor

Read-only access to controls, evidence, and policies. Auditors have a dedicated view optimized for audit work and are redirected to the auditor dashboard on login. They cannot see settings, integrations, or the People module.

Use this role for external auditors and certification bodies during an audit engagement.

Always invite external auditors as Auditors, not Users. The Auditor role keeps them out of internal settings and gives them a cleaner view focused on what they need.

Inviting team members

1. Go to Settings → Team
2. Click Invite member
3. Enter their email address
4. Select a role
5. Click Send invite

The invitee receives an email with a link to create their account. If they already have a Matproof account on another workspace, they can accept the invite with their existing login.

Changing a role

1. Go to Settings → Team
2. Find the team member
3. Click the role dropdown next to their name
4. Select the new role

Role changes take effect immediately.

Removing a user

1. Go to Settings → Team
2. Click the three-dot menu next to the user
3. Select Remove from workspace

Removing a user revokes their access immediately. Their past contributions (evidence uploads, control edits) are preserved.

Inviting external auditors

External auditors need access to review your compliance posture. The Auditor role gives them what they need without exposing internal settings.

Auditor portal

Auditors land on a dedicated dashboard showing controls, evidence status, policy documents, and risk register — organized for efficient audit review.

Read-only guarantee

Auditors cannot modify any records. They can download evidence files and export reports, but cannot create, edit, or delete anything.

Recommended audit workflow:

1. Invite your external auditor via Settings → Team with the Auditor role
2. Share the link to your workspace
3. The auditor accesses the auditor dashboard and reviews evidence at their own pace
4. Remove the auditor’s access after the audit is complete

Remember to remove external auditor access after the engagement ends. Leaving auditor accounts active is both a security risk and a potential finding in subsequent audits.

Feature flags

Some advanced features are controlled by feature flags at the organization level. These are not self-serve — contact Matproof support to enable them.

Feature flag	What it enables
ai-vendor-questionnaire	AI-assisted vendor questionnaire filling and response analysis
advancedModeEnabled	Advanced mode with additional configuration options for power users

If a feature you expect to see is missing from your workspace, it may be behind a feature flag. Reach out to support with your organization name to check.