Setting up your organization

Settings is a wide page with a tab strip across the top, and most of it you will never touch. This is the short list that pays for itself, in the order it is worth doing.

Do these before you import anything

1. Info — your legal identity.

   Settings → Info holds your organization’s own profile: name, contact details and legal identity. The identifiers here (your LEI or national company number) are the ones that appear on regulatory filings, so a guessed value is worse than a blank one. Fill it once, properly.

2. Criticality tiers.

   Settings → Criticality tiers. These are the bands every vendor is classified into, and they are yours to name, reorder, add to and retire. Each tier also carries the reassessment cadence for vendors in it, which is what lets the product tell you later what is overdue.

   Doing this first matters: change a tier after loading two hundred vendors and you are reclassifying two hundred vendors. See Criticality and classification.

3. Vendor categories, contract types and contract statuses.

   Three small lists, three tabs — Vendor categories, Contract types, Contract statuses — that populate the pickers on the vendor and contract forms. Add the words your organization already uses, and put the most common ones at the top with Move up.

   You can retire an entry later without breaking history: an inactive entry stops being offered on new records and stays on the ones already using it.

Then, once you know your shape

Business units — Settings → Business units. A hierarchy of the parts of your organization. On their own they are a filter; combined with roles, they are how you limit a person’s access to the units they actually work in. Worth creating when more than one team uses the product.

Custom fields — Settings → Custom fields. Fields of your own on vendors, contracts and other records, defined once and assigned to the record types that should carry them. Reach for this when you have tried the built-in fields and something your policy requires genuinely has no home. Custom fields can be mapped during an import like any other field.

Notifications — Settings → Notifications. Routing rules that decide which events reach email, Slack, Teams, a webhook or the in-app inbox, and at what minimum severity. The defaults are sane; tune them when people start either missing things or muting the product.

The security tabs

Security carries the organization-wide session controls — whether two-factor authentication is required, whether magic-link login is allowed, the idle timeout. SSO carries SAML identity providers and SCIM provisioning. Both are covered in Signing in securely.

Two settings pages, two different jobs

Settings → Roles decides what a role can do. Settings → Security decides how people get in. It is common to spend an afternoon on the first when the problem was the second.

What you can leave for later

Approval workflows, segregation of duties, test definitions, API keys, webhooks, connected agents, document templates and the AI budget are all real and all configurable — and none of them needs a decision on day one. Come back when a specific need points you at one.