My organizations

Duration: 5 minutes For whom: shared IT providers · cybersecurity consultants · admins who work across several SMEs · IT managers of multi-entity groups New in v0.9: a single account can now access several organisations at once, keeping a distinct role in each.

CyberPassport recognises two scenarios:

1. You are the primary member of an org (your SME, your main entity). This is the org created during your onboarding.
2. You are invited as an external provider in one or more other organisations (customers you support, subsidiaries you administer). These accesses are added to your primary org without replacing it.

💡 Good to know: your primary org always stays "yours" — your data, your reports, your Evidence Vault remain intact whatever happens with the other orgs.

Receiving an external invitation

On the client org admin's side

An admin of an org where you work (e.g. your SME client) invites you via Settings → Team → Invite an external provider.

📸 Screenshot location: external invitation modal with the "External" badge

The admin enters your email address + chooses your role (Admin / Collaborator / Auditor within their org).

On your side, the provider

You receive an email:

• Sender: noreply@cyberpassport.ch
• Subject (FR): "[CyberPassport] {Client org name} invites you as an external provider"
• Text: "You will keep your current account and your other organisations. This invitation simply adds {Org name} to your list of accessible organisations."
• Validity: 48 hours (shorter than standard invitations for security reasons)

📸 Screenshot location: external invitation email (FR mode)

Clicking the "Accept invitation" button:

• If you are already signed in to CyberPassport → automatic acceptance, redirect to the client org's dashboard.
• If you are signed out → login page, then acceptance after authentication.

⚠️ Important: the invitation email must match exactly the address of your CyberPassport account. If you have several addresses, ask the admin to use the one on your primary account.

The organisation switcher (OrgSwitcher)

As soon as you have 2 or more accessible organisations, a switcher appears in the left sidebar, just below the CyberPassport logo.

📸 Screenshot location: sidebar with the OrgSwitcher showing 3 orgs (1 primary + 2 external)

What it looks like

• A button with the name of the active org + your role + a drop-down arrow
• An orange "External" pill if you are a provider in that org
• On click: a list of all your organisations, with role and external badge where applicable

How to switch

1. Click the OrgSwitcher button in the sidebar.
2. Click the target org.
3. The page automatically reloads on the new org's dashboard.

🟣 Tip: your last active org is remembered between sessions (via a secure cookie). If you were working on your client Atelier Mécanique's org, at your next sign-in you'll be taken straight back to their dashboard.

💡 Good to know: on sign-out, the cookie is deleted so that another user of the same browser doesn't inherit your last org.

Your roles can vary from one org to another

This is a key feature of multi-org: you can be Admin in your own org but Auditor at a client.

Typical example for a cyber consultant:

Your rights are always limited to the role of the active org. If you are an Auditor at Atelier Mécanique, you won't be able to modify their answers, even if you are the Owner of your own agency.

Practical cases

Case 1 — Shared IT provider

You manage the IT of 3 watchmaking SMEs. Each SME grants you Admin access in its own CyberPassport instance.

• Advantage: a single account, a single password, one OrgSwitcher to switch between your 3 clients in 2 seconds.
• Security: each SME's data stays strictly isolated — you never see one SME's answers when you are on another's dashboard.

Case 2 — One-off audit consultant

A client invites you as an Auditor to review its assessment before publication.

• You accept the invitation → the client's org appears in your OrgSwitcher.
• When the assignment is over, the client can revoke your access (Settings → Team → Remove).
• Your primary org and your other clients remain unchanged.

Case 3 — Multi-entity group manager

You oversee 5 subsidiaries of the same industrial group. Each subsidiary has its own CyberPassport org.

• You ask the admins of each subsidiary to invite you as an external Admin.
• You can switch between subsidiaries to track the group's consolidated cyber maturity.
• ⚠️ The consolidated multi-client dashboard (an aggregated view of the 5 subsidiaries on one page) is planned for V2 — in v0.9, you switch manually.

Security and confidentiality

• Strict isolation: each organisation's data is compartmentalised by two independent barriers — systematic application-level filtering by organisation, and PostgreSQL Row Level Security as a second barrier, on our Switzerland-hosted database.
• The active org cookie is httpOnly and sameSite=lax — it CANNOT be read by JavaScript nor sent to another domain.
• The JWT contains the list of your accessible organisations — updated at each login (so a revocation takes effect at the latest at your next sign-in).

Known limits in v0.9

• External invitation is done by email (no directory search to add an existing user — V2).
• No in-app notification when you are invited to a new org (you only receive the email).
• No aggregated multi-org view (consolidated dashboard) — planned for V2.
• Switching the active org fully reloads the page (no instant SPA-style switch).

Frequently asked questions

Q: If I leave the client org, does my own data stay intact? A: Yes, completely. Leaving (or being removed from) an external org never affects your primary org or your other external orgs.

Q: Can a client admin see my personal data (other clients, etc.)? A: No. No admin sees the list of your other orgs. The only indicator on the admin's side is the "External" pill next to your name, which simply says "this user's primary org is not with us".

Q: With which role can I be invited? A: Admin, Collaborator or Auditor in the client's org. The choice belongs to the admin who invites you.

Q: How many orgs can share my account? A: No technical limit in v0.9. As a guideline, 10–20 orgs remains very comfortable from a UX standpoint.

📸 Final screenshot location: full screen showing the OrgSwitcher expanded in the sidebar, with a mix of primary + external orgs

Need help? Contact support@cyberpassport.ch.