Organization Settings

Overview

Organization Settings is the central place where administrators configure the core identity and preferences of their Fencer organization. From here you can update your organization name, logo, and unique identifier, set organization-wide defaults and remediation deadlines, manage organization email addresses, enforce security policies such as multi-factor authentication (MFA), and manage notification rules, automations, and API access. These settings affect all members of the organization and control how your organization appears across the platform.

Prerequisites

• You must have the Admin role in the organization to change settings. Changing them requires org_settings:edit; viewing them requires org_settings:read. The Automations page also requires automations:read to view and automations:edit to change.
• The Service Accounts and Personal API keys pages require api_keys:read; creating and revoking service accounts requires api_keys:create and api_keys:delete.
• To enable the organization-wide MFA requirement, your own user account must already have two-factor authentication enabled.

How it works

Organization settings are grouped into pages listed in the Settings sidebar. When you navigate to Settings, you land on the Organization page. Each page controls a distinct area of configuration: profile information, policy, email addresses, notifications, automations, authentication, and API access. Billing has its own Billing link under Admin, and members and roles are managed under Admin > Team.

Changes to organization settings take effect immediately. For example, updating the organization name or slug changes how URLs and display labels appear for all members right away. Certain sensitive actions, such as deleting the organization, require explicit confirmation to prevent accidental data loss.

Usage / Configuration

Accessing organization settings

1. Click Settings in the main navigation sidebar under the Admin section.
2. You will land on the Organization page. Use the sidebar menu to navigate between settings pages:
   • Organization — profile, identity, and organization-wide defaults
   • Policy — remediation SLA targets for vulnerabilities
   • Emails — organization email addresses
   • Notifications — organization notification rules (Slack channel, organization email, webhook, or people)
   • Automations — rules that open Linear or Jira issues (shown with automations:read)
   • Authentication — MFA enforcement, sign-in requirements, single sign-on, and SCIM provisioning
   • Service Accounts and Personal API keys — API access (shown with api_keys:read)

Updating organization profile

1. Navigate to Settings > Organization.
2. To change the organization logo, click Upload logo (Replace once a logo is set), or click or drop an image on the logo. Upload a PNG, JPEG, or WebP file of at least 400×400 pixels.
3. Under General, update the Organization name field with your organization’s official name.
4. Update the Organization slug if needed. It must be unique and can contain only lowercase letters, numbers, and hyphens. It appears in all organization URLs (e.g., /a/your-org-slug/...).
5. Click Save changes.

The top of the page also shows your Organization ID, with a button to copy it.

Caution

Changing the organization slug updates all URLs for your organization. Any bookmarks or shared links using the old slug will stop working.

Setting organization-wide defaults

The Organization page also holds defaults that apply across the organization. Change any of them and click Save changes:

• AI fixes — Automatically open a PR on AI fix opens a pull request when an AI fix attempt succeeds. Individual repositories may override it. See Automated Remediation.
• Fencer triage — Ignore confirmed false positives marks a vulnerability as ignored when Fencer triage confirms it is a false positive. Uncertain and true-positive results are never ignored. Individual repositories can override it. See Ignoring a vulnerability.
• Unpatched vulnerabilities — Defer vulnerabilities without an upstream patch defers newly found vulnerabilities in container images and on endpoints that have no upstream patch for any of their CVEs, and reopens them as soon as a patch is available. See Deferring a vulnerability.
• AI security reviews — Enable for all repositories by default offers an AI security review on new pull requests. Run reviews automatically when a pull request opens starts the review without waiting for a maintainer to confirm, and Re-run reviews automatically on each push starts a fresh review for each new commit. Individual repositories can override each of these. See AI PR Reviews.

Showing a status badge

The status badge is a small image with the Fencer logo and the word Protected that you can add to a README to show that Fencer protects your organization. It is off until you turn it on.

1. Navigate to Settings > Organization.
2. Under Status badge, turn on Status badge and click Save changes.
3. A Status badge card appears with a preview and the badge’s Markdown. Click the copy button and paste the Markdown into your README.

The image links to a public verification page that says your organization is protected by Fencer. The image URL contains an unguessable token, so it cannot be used to discover your organization. If you turn the badge off, the image shows Not Protected and the verification page shows a not-found page.

Setting a remediation policy

1. Navigate to Settings > Policy.
2. Under Deadlines follow, choose Severity to set deadlines by each vulnerability’s severity (Critical, High, Medium, Low, Info) or Priority to set them by its assigned priority (Urgent, High, Moderate, Low, Minimal).
3. For each level, turn on the switch and enter how many days a vulnerability has to be fixed (within N days, from 1 to 3650). A level that is switched off has no deadline and shows Best effort or No deadline. Every level starts on Best effort.
4. Set Flag as due soon to how many days before the deadline a vulnerability is flagged as approaching (1 to 365, 7 by default).
5. Click Save policy.

Deadlines run from when a vulnerability is first seen. The Impact column shows, for each level, how many open vulnerabilities would be overdue, due soon, or on track under the deadline you set.

Managing organization email addresses

Organization email addresses are used for receiving notifications and security alerts. Only verified email addresses can receive notifications.

1. Navigate to Settings > Emails.
2. To add a new email address, click Add email, enter the address in the Add email address dialog, and click Add email.
3. A confirmation email is sent to the address. Click the confirmation link in the email to verify it. Confirmation links expire after 3 days.
4. To resend a confirmation email, click Resend next to the unverified address. There is a 2-minute cooldown between resend attempts.
5. To remove an email address, click Remove next to it and confirm with Remove email. Notification rules that email this address stop sending to it until you choose a replacement address on each rule.

Note

Each email address can only be associated with one organization at a time.

Enforcing multi-factor authentication

1. Navigate to Settings > Authentication.
2. Under Multi-factor authentication, turn on Require MFA for all members. The setting saves immediately.

Once enabled, members without 2FA are prompted to set it up the next time they sign in. If your own account does not have MFA enabled, the toggle is disabled and a message prompts you to set up 2FA on your account first, with a Set up 2FA button.

Requiring or blocking sign-in providers

The Auth requirements section of Settings > Authentication controls which sign-in methods members of your organization may use. It is a paid feature; without it, the section shows Upgrade to unlock.

1. Navigate to Settings > Authentication and find Auth requirements. Each provider (Google, Microsoft, GitHub, GitLab, Bitbucket, and Password) shows how many members currently sign in with it.
2. Choose Allow, Require, or Deny for a provider.
3. To require a provider, enter the constraint it asks for and click Save: an Email domain for Google or Microsoft, an Organization for GitHub, a Group path for GitLab, or a Workspace for Bitbucket. You must be signed in with that provider yourself before you can require it.

Password sign-in can be denied but not required. Single sign-on (SAML 2.0 or OpenID Connect) and SCIM provisioning are configured on the same page; see SSO and Authentication.

Managing API access

Settings > Service Accounts holds API tokens for non-interactive tools such as CI pipelines, and Settings > Personal API keys is where you approve, reject, or revoke the personal API keys your members point at the organization. See API Access.

Deleting an organization

1. Navigate to Settings > Organization.
2. Scroll to the Danger zone section at the bottom of the page.
3. Click Delete organization. The dialog lists what deletion does:
   • Cancels the billing subscription.
   • Permanently removes all organization data.
   • Emails all members that the organization was deleted.
4. Type the organization name exactly as shown to confirm.
5. Optionally provide a reason for deleting.
6. Click Delete organization to finalize.

Caution

Organization deletion cannot be undone. All data associated with the organization will be permanently removed.

Examples

Rebranding your organization: If your company changes its name, navigate to Settings > Organization, update the Organization name, upload a new logo, and adjust the Organization slug to match your new branding. Click Save changes to apply.

Setting up notification emails: Navigate to Settings > Emails, add your security team’s shared mailbox (e.g., security@yourcompany.com), verify it via the confirmation link, and then create a rule under Settings > Notifications with the Send organization email destination to route alerts to that address.

Committing to a 7-day fix time for critical findings: Navigate to Settings > Policy, keep Severity selected, switch on Critical and enter 7 days, then click Save policy.

Troubleshooting

• Cannot enable MFA requirement: Your own user account must have two-factor authentication enabled before you can enforce it organization-wide. Click Set up 2FA, or open Security in your user settings, and complete setup first.
• Organization slug change breaks links: If you change the organization slug, all existing URLs referencing the old slug will return a 404. Update any bookmarked or shared links accordingly.
• Email confirmation not arriving: Check your spam folder. If the confirmation email still does not arrive, wait at least 2 minutes and click Resend. Confirmation links expire after 3 days.
• Cannot require a sign-in provider: Sign in to Fencer with that provider first. Password sign-in can only be denied.
• Cannot change settings: Only users with org_settings:edit (the Admin role) can change organization settings. If you see a permission error, contact an organization administrator to verify your role.

Related pages

• Roles and Permissions
• Team and Member Management
• Billing and Usage
• SSO and Authentication
• User Preferences
• Notifications and Alerts