Organizations & projects

Organizations

An organization is your tenant. It owns every project, member, role, token, and setting, and it's the hard boundary for data isolation — nothing crosses between organizations. You can belong to several and switch between them.

Projects

A project lives inside an organization and maps to one repository, service, or product. SBOMs, scans, findings, and decisions are all scoped to a project, and project dashboards roll up into an organization-wide view.

Creating a project (import-first)

Project creation is import-first, Vercel-style. From Projects → New project you have two modes:

• Import Git Repository (primary) — pick a repo from your GitHub App install, set the name, root directory, branch, and SBOM source, and TraceGuard creates the project and links the repo in one step. This is the recommended path.
• Start blank (fallback) — name, description, visibility, and scan schedule, with no repo. Use it for projects fed by manual upload or CI.

One project tracks one repo. For a monorepo, import the same repo once per service, each with its own root directory.

Project visibility

Every new project is Organization-wide unless you choose otherwise:

• Organization-wide (the default) — everyone in the organization can see the project, its SBOMs, findings, and linked GitHub repository. Members get read access; organization owners and admins, and the project's own admins (including whoever created it), manage it.
• Private — not open to the whole organization: organization owners and admins, the people you add to the project's members list, and organizations you share it with can see it.

You can change a project's visibility later under Settings on the project.

Each project then has its own:

• Members & access — who can see and act on it.
• Integrations — the linked repo's git-sync settings and deploy tokens.
• Scan policy — whether and how often scans run on a schedule.

Next

• Getting SBOMs in — the SBOM sources in detail.
• Members & access — invite your team.