Skip to content
Back to Guides

Organisation administration

Manage your team and roles, billing, notifications, API keys, and SSO/MFA.

Organisation administration covers the settings a pip_admin or pic_admin owns: who is on the team, how you are billed, how you are notified, and how you and your integrations authenticate.

Team, roles & invitations

Invite colleagues by email; each invitation carries a role, and the invitee sets their own password through their own link. You never share credentials.

Where to find it depends on the app:

  • Producer app — Administration → Team
  • Buyer portal — the team section of Settings

Roles decide what someone can do. An administrator can invite editors and subscribers; only an administrator manages people, grants, API keys and billing. Who does what in the overall process, with examples for both sides, is described in Roles & responsibilities; the full matrix is in Roles & permissions.

Invitations expire. If one lapses, resend it from the same screen rather than creating a second invitation for the same person.

Billing & plan

Every organisation is on a plan, and the plan decides how much of the platform you can use — how many products and people, how much storage, which features, and how fast you may call the API.

Signing up puts you on the free plan of your side — Free for a producer, Buyer for a buyer. It does not expire and does not ask for a card.

From Settings → Billing you can see your plan, your current usage against each limit, your invoices, and, as a producer, move up a plan. Buyers see their own ladder there too, but the paid buyer plans are arranged with us rather than bought in the app. Paying opens your payment provider's checkout — card or SEPA direct debit — and managing an existing subscription (changing plan, updating a card, cancelling) happens in their portal, reached from the same page. PIE deliberately does not handle card details.

Two things worth knowing before you buy:

  • Published prices exclude VAT. VAT is added at checkout where it applies; businesses elsewhere in the EU with a valid VAT identification number are not charged it, and the invoice records why.
  • A yearly producer subscription is charged as ten months.

Approaching a limit does not surprise you. As usage nears a ceiling the app shows a warning naming the limit, with a link to billing. Only at the ceiling is the action refused, with a message saying which limit it was. Reading is never blocked — you can always see your plan and usage.

Cancelling is a downgrade, not a shutdown. Your organisation returns to the free plan of its side; published products, passports and portals keep working. You simply cannot create beyond the free limits until you subscribe again.

See Plans & limits for the current numbers and Plans, entitlements & billing for the model.

Notifications

PIE notifies your team about events that matter — publishes, grants, workflow tasks, sync results, and account security. Manage delivery preferences (immediate or digest) from your notification settings; the catalog and templates are localized into your enabled languages. Account-security notifications are always on.

API keys

Create API keys for machine-to-machine integrations from the API Keys page. Keys carry scopes and can be marked sandbox (read-only). The secret is shown once — store it securely. Rotate a key to mint a replacement with a grace window, then revoke to invalidate. See the Authentication guide.

SSO & MFA

Organisations on any paid plan (producers from Starter, buyers from Buyer Team) can configure single sign-on (SAML or OIDC); every plan, Free included, can require multi-factor authentication and session policies. Configure SSO connections and enforce MFA from your organisation's security settings; sign-in then honours your SSO and MFA requirements. On Free, creating or enabling an SSO connection is refused with PLAN_UPGRADE_REQUIRED. Moving down to Free never switches off a connection that is already enabled, so nobody is locked out, but it cannot be re-enabled until you upgrade again. A claimed email domain only routes people to your identity provider once you have proven you own it: the connection page shows a TXT record (pie-verification=… at _pie-verification.<your domain>) to publish in the domain's DNS, and Verify checks it. Until then the claim is stored but nobody is sent to your IdP — which is what stops anyone from claiming a domain that is not theirs. Public email providers (such as gmail.com) cannot be claimed at all.

Related