Companies

Companies (called "Clients" in the sidebar) represent the organizations you perform assessments for. Each company can have multiple contacts and be linked to multiple reports.

Contacts

Each company can have multiple contacts. Contacts are the people at the client organization who receive the report, approve the scope, or serve as your points of contact during the assessment. Each contact can have:

• Name
• Email address
• Phone number
• Role or job title (e.g. CISO, Security Consultant, CTO)

Contacts in reports

When creating a report, you select a company and then choose which contacts to include. Selected contacts become available as template variables:

• client.primaryContact - the main contact
• client.contacts - all selected contacts

This lets your report template automatically populate the cover page, distribution list, and contact information sections with the right names and details for each engagement.

Team access and visibility

If your organization uses teams, a company's visibility can be restricted to specific teams. Team members only see the companies (and by extension, the reports) that their team has access to. This is configured by administrators through the team exclusion list settings.

See Teams for more details on team-based access control.