Common journeys

An owner connects the first site

1. Register and create the organisation. Check Current account setup limits; live new PAYG activation remains unavailable; enabled test accounts use the separate card and activation steps.
2. Check the organisation owner's time zone and current plan.
3. If site activation is available for your account, add a site and open Connection. Otherwise use Skip for now where offered or contact Support.
4. Add its API key, new or existing, and configure Drupal.
5. Send inventory and verify receipt in Logs.
6. Wait for assessment and inspect coverage in Summary.
7. Set a security patching SLA and, if you want one, a maintenance update SLA if the plan includes them, when adding the site or later in Edit site.
8. Invite team members with the minimum role they need.

An agency serves several clients

1. Use a billing account you own and administer. Agency needs an active paid subscription from its first site; creating empty client organisations does not require an Agency upgrade.
2. Create a separate organisation for each client that needs a separate membership boundary.
3. Check the shared site allowance and the 50-person capacity, including pending invitations, before adding sites or members. If you own several billing accounts, the current dashboard cannot choose one for a new organisation; contact Support.
4. Switch to each client organisation, add and connect its sites, and set its patching targets.
5. Invite client readers as Users in only the appropriate organisation.
6. Review fleet findings, messages, and missed check-ins in that organisation.
7. At month end, check the evidence, issue or review the report, add an authorised note, and verify the version before sharing.

A client report filter inside one organisation does not isolate that client's membership from the rest of the organisation. Use separate organisations where separate access is required.

A client reviews an agency's work

1. Accept the invitation with the addressed account.
2. Select the client organisation.
3. Review Home and expand the site's patching history.
4. Open Summary and Updates to inspect evidence and open findings.
5. Read Messages and acknowledge those that require it.
6. Open the monthly report when the plan allows it, select the period, and read any missing-data qualifications.
7. Ask the administrator about findings, plan access, or corrections. A User role cannot manage keys, members, or billing.

A maintainer resolves a security finding

1. Open the finding and read the installed version, advisory, recommended release, and assessment age.
2. Apply and test the Drupal update through the site's normal maintenance process.
3. Send a fresh Connector inventory.
4. Check both request receipt and later processing in Logs.
5. Check that the new assessment is complete and fresh, or read its coverage limitations.
6. In Updates, check whether the finding remains outstanding and read its reason. If resolved, read the resolution basis and both times under Resolved advisory evidence. Check Update history and the SLA result separately. Read or acknowledge any relevant message after investigating the actual condition.