Manage your organization's account, team members, and platform settings.
Getting Started
Using the Platform
FAQs & Support
<aside> 🔗
</aside>
Access the following settings by clicking on your name and email in the top right corner.
Your User Profile is where you manage your personal account information, security settings, and notification preferences. To access your User Profile, click your account name in the top right corner and select User Profile. [1]
User Account [1]
Update your name and email address. Your name is used for attribution when commenting on findings.
Phone Numbers [2]
Add a primary number to your profile. Phone numbers are used for contact purposes by your Sprocket team.
Two-Factor Authentication [3]
Two-factor authentication (2FA) is required for all users during creating an account. If you need to reset your 2FA method, click Reset and follow the prompts. Use Generate new recovery codes to create backup codes in case you lose access to your authenticator app.
API Credentials [4]
This is where you can generate API Credentials to utilize the Sprocket Platform Public API, more details on accessing the API can be found here: Sprocket Platform Public API and details on configuring and managing organization credentials can be found here: API Credentials
<aside> <img src="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" alt="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" width="40px" />
Permissions Note: Client Managers will have an additional menu item under their User Account called API Credentials, where they can manage Organization Credentials. See details here: API Credentials
</aside>
Notification preferences control when and how you are notified about findings activity. Notifications are sent to users assigned as a Point of Contact on a project. If you are not assigned as a POC on a project, you will not receive notifications for that project regardless of your preferences. Reach out to the user in your organization that has the Manager role if you need to be assigned to additional Projects.
The default for all notification types is Immediately. A newly assigned POC will begin receiving notifications without any additional setup.
Finding Notifications
| Notification | Description |
|---|---|
| Finding Assignments | A finding has been assigned to you |
| Finding State Changes | The state of a finding has been updated |
| New Comments | A new comment has been added to a finding |
| New Findings | A new finding has been published |
| Retest Completed | |
| Retest Reclaimed | |
| Service Level Agreement Changes | An SLA threshold has been modified |
| Unresolved Critical Findings | A Critical finding remains unresolved |
Testing Notifications
| Notification | Description |
|---|---|
| Manual Testing Started | A Sprocket tester has started manual testing on your environment. |
| Testing About To Be Resumed | A Blackout Window is coming to an end, and testing will restart. |
| Testing IPs Changed | IPs that Sprocket testers use have been updated, these can be found on the External or Web Application Project pages. |
| Testing Paused Reminder | A reminder that a Blackout Window is in effect and no testing is being conducted. |
<aside> <img src="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" alt="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" width="40px" />
Tip: Finding notifications can be routed through Slack or Microsoft Teams in addition to email. See Integrations to configure your notification channels.
</aside>
To update your password, click Change Password. An authentication code will be required to complete the change.
The Company Profile page is shared across your organization. Any changes made by a Client Manager apply to all users. To access Company Profile, click your account name in the top right corner and select Company Profile..
<aside> <img src="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" alt="notion://custom_emoji/ede23b80-db43-4102-883e-d404c44f363c/32f14309-3808-804c-a39b-007a3a539ba4" width="40px" />
</aside>
Update your organization's primary contact email, phone number and company address.
SLA settings define how long findings may remain open before a violation is triggered. SLA thresholds can be configured at the organization level here, or per project. Project-level settings supersede organization-level defaults. All users are notified when a finding has violated your SLA policy.
Organization-level SLA can only be configured by a Client Manager. Changes apply organization-wide. If multiple Client Managers update SLA settings, the most recent change takes effect.
| --- | --- |
You can disable the SLA feature entirely for all projects by selecting Disable Service-Level Agreement feature for all projects.
Project-Level SLA
SLA can also be configured per project from the project's Engagement Details page. Both Client Managers and Client Users can configure project-level SLA. Project-level settings override the organization defaults for findings in that project. If multiple users update project SLA settings, the most recent change takes effect.
AI Integration is on by default. Users can generate AI-powered remediation suggestions directly from published findings. This is an organization-level setting: if a Client Manager turns it off, it is off for all users in the organization.
The Team Members page allows Client Managers to view and manage all users that have access to your organization's account. To access Team Members, click your account avatar in the top right corner and select Team.
Each team member record displays: