Organization, members, and billing

An organization is an Orthalon tenant. Its members, policies, devices, events, connector credentials, and purchases must remain isolated from every other organization.

Manage organization details

Open Administration → Organization to update the display name and other organization settings. Changing the organization slug changes its dashboard URL, so update bookmarks and operational documentation.

Use the organization selector to switch tenants. Always verify the organization name before provisioning keys, changing policy, exporting evidence, or configuring a provider.

Manage members

Open Organization → Members.

• Invite users through their work email.
• Give members the least privileged role that supports their job.
• Reserve owner and administrator roles for people who configure security controls.
• Remove accounts promptly when access is no longer needed.
• Keep at least two tested organization administrators.

SCIM on Enterprise can automate membership, but you should still review privileged Orthalon roles separately.

Understand seats

A seat is an organization member. Monitor supports up to 25 seats. Paid subscriptions use the current member count as their quantity, including provisioned members who have not yet used a sensor.

Review membership before checkout and after large identity-provider changes.

Manage the plan

Open Organization → Billing.

• Upgrade to Protect or Business with monthly or yearly billing.
• Use the customer billing portal for supported subscription changes.
• Contact sales for Enterprise provisioning.
• Confirm the active plan in Orthalon after checkout or a portal change.

Plan gates are server-side. If a feature still appears unavailable after a successful purchase, verify the organization, completed webhook delivery, and active purchase record before re-running checkout.

Delete an organization

Organization deletion is destructive and affects tenant-scoped security data. Before deletion, export permitted evidence, revoke sensors and SCIM tokens, disconnect providers, stop endpoint agents, and resolve the subscription. Perform deletion only from the intended organization's danger zone.