Organizations & projects

Organizations

An organization is your tenant. It owns every project, member, role, token, and setting, and it's the hard boundary for data isolation — nothing crosses between organizations. You can belong to several and switch between them.

Projects

A project lives inside an organization and maps to one repository, service, or product. SBOMs, scans, findings, and decisions are all scoped to a project, and project dashboards roll up into an organization-wide view.

Creating a project (import-first)

Project creation is import-first, Vercel-style. From Projects → New project you have two modes:

• Import Git Repository (primary) — pick a repo from your GitHub App install, set the name, root directory, branch, and SBOM source, and TraceGuard creates the project and links the repo in one step. This is the recommended path.
• Start blank (fallback) — name, description, visibility, and scan schedule, with no repo. Use it for projects fed by manual upload or CI.

One project tracks one repo. For a monorepo, import the same repo once per service, each with its own root directory.

Each project then has its own:

• Members & access — who can see and act on it.
• Integrations — the linked repo's git-sync settings and deploy tokens.
• Scan policy — whether and how often scans run on a schedule.

Next

• Getting SBOMs in — the SBOM sources in detail.
• Members & access — invite your team.