Organizations: workspaces, members, and settings

An organization is your top-level workspace in Zespan. It contains your projects, holds your billing subscription, and groups the team members who can access your data. Every project you create belongs to an organization, and all usage — events ingested, data retained, and members invited — counts against that organization’s plan. You can belong to multiple organizations and switch between them at any time.

Creating an organization

When you sign up for Zespan, the onboarding wizard walks you through creating your first organization automatically. If you need additional organizations later, you can create up to 3 organizations per account. The shared demo you can open with Explore the demo is not one of them: it doesn’t count toward that limit and is shown as Demo (read only) in the switcher — see Quickstart → Explore the demo.

Open the org switcher

Click the organization name in the top of the left sidebar. At the bottom of the dropdown, select Create new workspace.

Name your organization

Enter a display name for the organization. This name appears in the sidebar and in email notifications to your team.

Create your first project

Give your first project a name. A project is the ingest scope that your SDK will target — each project gets its own API key.

Install the SDK

Copy the SDK snippet shown on screen and add it to your application. The snippet includes your project’s API key pre-filled.

See your first data

Zespan waits for your first event to arrive. Once it does, you’re redirected to the project dashboard automatically.

Switching organizations

The org switcher is the dropdown in the top of the left sidebar. Click it to see all organizations you belong to, then select one to switch your active context. Everything in the dashboard — projects, usage, settings — reflects the selected organization.

Inviting team members

You can invite teammates to your organization from Settings > Team. Invitations are role-scoped, so you assign a role at the time of invite.

The Free and Solo plans are limited to 1 member (the owner). You must be on the Pro plan or higher to invite additional members.

Open team settings

Navigate to Settings > Team within your organization.

Click Invite member

Enter the teammate’s email address and select a role — Admin, Editor, Viewer, or Billing.

Send the invitation

Click Send invite. Zespan sends an email to that address with a link to accept. Invitations expire after 7 days if not accepted.

You can view pending invitations in the same Team settings page and resend or cancel them at any time.

Accepting an invitation

The email links to a page that shows the organization and the role you were invited with. You must be signed in (or sign up) with the same email address the invitation was sent to; a different account sees “This invitation is for a different account” and can sign out to switch. Choose Join or Decline. After joining you land in the organization you joined. A link that was already accepted, withdrawn, declined, or has passed its 7 days shows that state and tells you to ask an admin for a new invitation.

Seats

Each member takes a seat. The Members page shows Seat usage and how many seats are left, and counts people you’ve invited but who haven’t joined as using a seat, so the figure matches what you can still invite. When no seat is free, the invite dialog says every seat is taken. The API itself refuses a new invitation once your joined members fill the plan, with 403 and code SEAT_LIMIT_REACHED (Seat limit reached for the <plan> plan (max N). Upgrade to add more members.). Removing a member frees a seat.

Roles and permissions

Zespan has five roles: Owner, Admin, Editor, Viewer, and Billing. There is no role literally named “Member” — every teammate you invite gets one of these five.

Permission	Owner	Admin	Editor	Viewer	Billing
View dashboards and traces	Yes	Yes	Yes	Yes	Yes
Export traces	Yes	Yes	Yes	No	No
Manage projects	Yes	Yes	No	No	No
Manage API keys	Yes	Yes	No	No	No
Manage evaluations and simulations	Yes	Yes	Yes	No	No
Manage guardrails and prompts	Yes	Yes	No	No	No
Manage alerts and incidents	Yes	Yes	Yes	No	No
Manage agents	Yes	Yes	Yes	No	No
Use AI features (ZespanPilot, etc.)	Yes	Yes	Yes	No	No
Manage team members	Yes	Yes	No (view only)	No (view only)	No (view only)
View audit log	Yes	Yes	Yes	Yes	Yes
View billing	Yes	Yes	No	No	Yes
Manage billing and payment	Yes	No	No	No	Yes
Manage organization settings	Yes	Yes	No	No	No
Delete the organization	Yes	No	No	No	No

Editor cannot manage guardrails or prompts — those are treated as high-risk operations reserved for Admin and Owner. Billing is a narrow role: it can view traces and dashboards like Viewer, but its only management permission is billing — it cannot touch projects, alerts, or team settings.

Every organization has exactly one owner — the person who created it. Ownership cannot be transferred through the dashboard.

Changing a member’s role

In Settings > Team, each member row has a role selector. Owners and Admins can change any member’s role between Admin, Editor, Viewer, and Billing. You cannot change the owner’s role.

Removing a member

Click Remove next to any member in Settings > Team to revoke their access immediately. Removed members lose access to all projects in the organization. The owner cannot be removed.

Requiring two-factor authentication

An owner can require every member to use an authenticator app. Go to Admin → Settings → Security and turn on Require two-factor authentication for all members.

Owner only. Admins see the setting but can’t change it.
Owners are exempt, so the people who can turn the setting off can never be locked out.
You need it yourself first. Turning the requirement on fails until your own account has a verified authenticator app. Turning it off is never blocked.
Authenticator apps only. Email one-time codes don’t satisfy the requirement. Enrolment is complete only after you enter a code from the app under Settings → Profile → Security.
API keys are unaffected. SDK and ingest requests authenticated with a project API key keep working.

While the requirement is on, a member without a verified authenticator app can’t use the organization’s projects in the dashboard, the CLI, or the MCP server. They see Two-factor authentication required with a link to Settings → Profile → Security, and can still enrol, sign out, switch organizations, accept invitations, and leave the organization. Team-management actions — inviting members, cancelling invitations, changing roles, removing members, and renaming or deleting the organization — also require the acting member’s verified two-factor authentication (owners exempt). Each change to the setting is recorded in the audit log as org.require_2fa.enabled or org.require_2fa.disabled.

Error code	Status	Meaning
`2fa_required`	403	The organization requires two-factor authentication and your account has no verified authenticator app.
`2fa_required_to_enable`	409	Enable two-factor authentication on your own account before requiring it for the organization.

AI processing

Zespan’s own AI features send your organization’s trace data to Zespan’s AI model providers. The organization-level AI processing setting governs whether they may, and it is on by default. The dashboard doesn’t currently show a control for it, so there is nothing to change from Admin → Settings. Changes to the setting are still recorded in the audit log as org.ai_processing.enabled or org.ai_processing.disabled. When the setting is off for an organization:

Feature	What happens
ZespanPilot chat, the AI Hub (natural-language questions, cost optimisation, anomaly analysis, prompt optimisation, diagnose error), trace root-cause analysis and verdict explanations, incident analysis and fix suggestions, issue investigation, Prompt Enhance, AI-written expected outputs when building a dataset from traces, policy backtests of Semantic Judge rules on Zespan AI credits, and the MCP verdict-narrative and remediation tools	Not available. The dashboard shows a banner and disables the inputs, and the API answers `403` with `code: "AI_PROCESSING_DISABLED"`.
Overview and AI Hub summary	You get the rule-based summary, labelled Rule-based summary — AI processing is off.
Guardrail rules that run on Zespan AI credits	Not evaluated. Each such rule follows its If the check can’t run setting, and no credits are used. See Guardrails.
Background analysis	Anomaly detection, incidents, and cost analysis keep their statistical and rule-based output; only the AI step is skipped. Incidents state that no AI cause analysis was run, and AI cost recommendations and automatic issue remediation aren’t produced.
Features that use your own LLM connection (evaluations, simulations, Playground, guardrails set to Run on: your connection, dataset runs)	Not affected.
Ingest, traces, dashboards, and non-AI guardrail rules	Not affected.

A change to the setting applies across Zespan within about 35 seconds. An AI request that’s already running when it changes finishes; only requests that start afterwards are affected. If Zespan can’t read the setting for a moment, it treats AI processing as off for that request.

From the API

PATCH /v1/orgs/{orgId}/ai-processing with body { "aiProcessingEnabled": false } changes the setting. Owner only: other roles get 403 FORBIDDEN. Returns { "aiProcessingEnabled", "updatedAt" }.
GET /v1/orgs/{orgId} includes aiGovernance: { aiProcessingEnabled, updatedAt }.
GET /v1/ai/models lists the AI model in use for each Zespan AI feature (pilot, ask, overview_summary, analysis, guardrail_judge) and whether AI processing is enabled.

Renaming your organization

Go to Settings > General and update the Organization name field. The new name takes effect immediately across the dashboard and in any email notifications.

Deleting an organization

Deleting an organization is permanent and cannot be undone. The organization, its projects, members, and invitations are removed immediately, and every project’s API keys stop working at once. Trace and event data is purged shortly afterwards — usually within about an hour. Your billing subscription is cancelled at the end of the current period. See Data retention and deletion.

Only the owner can delete an organization. To do so, go to Settings > General, scroll to the Danger zone section, and click Delete organization. You will be asked to confirm by typing the organization’s name.

Plan limits for members

Plan	Members included
Free	1 (owner only)
Solo — $39/mo	1 (owner only)
Pro — $149/mo	Up to 10
Team — $299/mo	Up to 15
Scale — Custom	Unlimited

To add more members than your plan allows, upgrade from Settings > Billing. See Billing for a full plan comparison.

You can’t delete your own Zespan account while you’re the only owner of an organization. Delete the organization first — see Privacy.

Next steps

Account security — password, two-factor authentication, sessions, and CLI terminals
Privacy — your privacy choices, data export, and account deletion
Data retention and deletion — what deleting a project or organization removes
Audit log — every action taken in your organization

AI Providers (BYOK)

Deployment

Security & Compliance

Account

Organizations: workspaces, members, and settings

Creating an organization

Switching organizations

Inviting team members

Accepting an invitation

Seats

Roles and permissions

Changing a member’s role

Removing a member

Requiring two-factor authentication

AI processing

From the API

Renaming your organization

Deleting an organization

Plan limits for members

Next steps

​Creating an organization

​Switching organizations

​Inviting team members

​Accepting an invitation

​Seats

​Roles and permissions

​Changing a member’s role

​Removing a member

​Requiring two-factor authentication

​AI processing

​From the API

​Renaming your organization

​Deleting an organization

​Plan limits for members

​Next steps

Creating an organization

Switching organizations

Inviting team members

Accepting an invitation

Seats

Roles and permissions

Changing a member’s role

Removing a member

Requiring two-factor authentication

AI processing

From the API

Renaming your organization

Deleting an organization

Plan limits for members

Next steps