Organizations
The organization is the top-level container. Everything in TigerGate — repos, cloud accounts, scans, findings, schedules, API keys — belongs to exactly one org. Data never crosses an org boundary. Most customers have one org per company. Use multiple when:- You’re an MSP / consultancy running TigerGate on behalf of multiple clients.
- You need hard isolation between environments or business units (e.g. EU vs US for data-residency reasons).
Teams
Teams sit inside an org. Each user belongs to zero or more teams. Teams don’t grant roles — they scope which resources and which products a member can see. A member’s effective access is the union across every team they’re in: the resources assigned to any of their teams, and the products allowed on any of their teams.Team product restrictions
Each team can be scoped to a subset of TigerGate products (Code Security, Cloud Security, Container Security, Pentest/DAST, Runtime Security, and more). A user onteam:app-services restricted to Code Security only won’t see cloud accounts or pentest findings even if their org role would otherwise allow it.
Configure this from the Team page (left sidebar → Team): create or edit a team and choose its allowed products. Common patterns:
team:app-developers→ Code Security onlyteam:cloud-platform→ Cloud + Container onlyteam:security→ all products (cross-cutting)
A member can also be restricted at the individual level via Restrict product access on their invite or member row, independent of team membership.
Roles
Roles are org-level — each member holds exactly one role in the organization. Teams do not carry permission-bearing roles; team membership only scopes resource and product visibility.| Role | Can |
|---|---|
| Owner | Everything, including deleting the organization and granting or changing the owner role. |
| Admin | Manage members, teams, invitations, integrations, settings, and scans. Cannot delete the org or change the owner role. |
| Member | Standard access — scan and triage findings within their allowed products and resources. |
| Viewer | Read-only access. |
Team-based resource access
Beyond product scoping, individual resources are assigned to teams. Supported resource types are repositories, container images, cloud accounts, pentest targets, Kubernetes clusters, and assets.- Assign a resource to a team and only members of that team can see it.
- A resource can be assigned to more than one team.
- Owners and admins always see everything.
- If the org has no team assignments for a resource type, everyone sees that type (backward-compatible default).
- Once any resource of a type is assigned to a team, users who aren’t in a team holding one of those resources see nothing of that type.
Inviting users
Left sidebar → Team → Invitations (or Members) → Invite User.- Email — the invite goes to this address.
- Role — Viewer (read-only), Member (standard), or Admin (full access except ownership). The owner role can’t be assigned from the invite dialog.
- Team — optional. Leave as No team — organization-wide access, or pick a team to scope the user’s resource visibility on join.
- Restrict product access — optionally limit the user to a subset of products.
Multi-factor authentication (MFA)
TigerGate supports TOTP-based MFA per user, using any standard authenticator app (Google Authenticator, Authy, etc.).| Setting | Where |
|---|---|
| Enable MFA on your own account | Account Settings → Security — scan the QR code with your authenticator app, then confirm a 6-digit code |
| Backup codes | Issued once on enrolment (ten single-use codes) — store them offline |
Failed-login protection
After 5 failed password attempts, the account is temporarily locked. Subsequent attempts return a generic error (no enumeration). The lock clears automatically after 30 minutes, after which a correct password signs you back in and resets the counter.SSO
TigerGate supports SAML 2.0 single sign-on (available on Business and Enterprise plans). The integration is generic and works with any SAML 2.0 identity provider (Okta, Azure AD, Google Workspace, OneLogin, Auth0, JumpCloud, and others). Configure it at Organization → Single Sign-On. You provide the IdP SSO URL, an X.509 signing certificate, and one or more allowed email domains; TigerGate returns the SP entity ID, ACS URL, and metadata URL to paste into your IdP.- JIT provisioning is on by default. A user who signs in via your IdP with an allowed email domain is auto-added to the organization with the configured default role (Member by default). Turn JIT off to require that the account already exist.
- Enforce SSO blocks password login for the configured domains.
- Attribute mapping lets you map IdP attribute names to the user’s email and first/last name when the defaults don’t match your IdP.
JIT-provisioned users join the organization, not a specific team. Assign them to teams afterward to scope their resource and product access.
Audit log
Key state changes are recorded to the audit log, including:- User login / logout
- Team created / updated / deleted
- API key and IDE key created / deleted
- Repository re-baselined
Billing
Billing lives under Organization in two tabs:- Subscription — current plan, billing period, and next billing date, plus Manage Billing and Cancel Subscription.
- Invoices — invoice history.