Rollout

Organization → Rollout is about getting your people onto the product, not about installing anything. PulsVault is hosted, so there is no instance of your own to configure — what an organization actually needs from a page with this name is the other thing: everyone signed in, with sensible settings already in place, and the commands their engineers need in a form they can paste.

Five things do that job, and they live in several places:

What	Where
What a new member's apps start on	Member defaults
The timezone and date format a new member starts on	Locale defaults
What members see that says "this is ours"	Branding
What is still outstanding, and the CLI and pipeline commands	Rollout, which has two tabs: Checklist and Developers
Getting people invited	Roles & permissions

Member defaults#

Organization → Member defaults → Member defaults sets what a new member's apps look like before they change anything. It has three sections:

Section	Controls
Appearance	Language, Theme (Light, Dark, or following the member's device)
Vault session	How long a vault session lasts: 5, 15 or 30 minutes, 1, 4 or 8 hours, or until logout
Clipboard	Clear copied secrets (On or Off), and Time before it is cleared: 10, 30 or 60 seconds, or 2 minutes

A card at the top, What "not set" means, states in a sentence how many of these you have chosen. The password generator's starting values live on the Password page (What New Members Start On), and the timezone and date format on Locale defaults. Every change saves as soon as you pick it.

Every control has three positions, not two:

Position	Means
Not set	Your organization has not chosen. The member gets the PulsVault default.
On / a value	New members start on this.
Off	New members start with it off.

"Not set" and "Off" are different answers, and the difference matters most where you would expect it least: leaving the vault session length or clipboard clearing unset applies PulsVault's own default, which is the stronger choice. Setting clipboard clearing to Off removes it. A page that offered only a switch would have to pick one of those for every organization that never opened it.

Changing a default does not touch anyone already here#

Saving affects who joins next. Nobody currently in your organization is altered, and that is deliberate: someone who arrived with a working personal account has a configuration that is theirs, and quietly replacing it because an administrator set a default takes something away.

Apply to all members#

When you genuinely need everyone on the same values, the page has an explicit Apply to all action at the bottom, in a section titled Apply these to everyone. It writes more than the three sections above show: it also overwrites the password generator defaults (from the Password page) and the Locale defaults (timezone and date format) on every active member. The button says how many members it will touch, and the page tells you how many values it will write per member when that is more than the visible controls. It:

• tells you how many members it will affect before it runs,
• overwrites what those members have chosen for themselves,
• writes one entry to your audit log,
• and cannot be undone — members would have to set their preferences again.

It applies only the values you have actually chosen. If your organization has set nothing, the button is disabled rather than reporting a successful run that did nothing.

Locale defaults#

Organization → Member defaults → Locale defaults sets the timezone and date format members start on when they join.

Setting	Notes
Default timezone	Empty, it reads Follow each member's browser and each member's own browser decides
Default date format	Empty, it reads Use the product default. Once chosen, Today would read … shows what the format looks like

These are defaults, not a policy. Every member can change both on their own Preferences page, and saving here never overwrites a choice someone has already made. The one exception is not on this page: Apply to all on Member defaults overwrites these two values on every existing member.

Changes save as soon as you pick them. One thing may surprise you: the first time an administrator opens this page on an organization that has never chosen a timezone, it saves the timezone of that administrator's browser as the default and says so in a message. It is a starting value like any other — change it whenever you like.

Branding#

Organization → Organization → Information carries your organization's own identity, on the Enterprise plan:

Field	Where it shows
Display name	Everywhere the product would otherwise say "PulsVault" to your members
Accent colour	The console's accent for your members
Support contact	The help link in your members' console
Logo	Your members' console header

This is white-labelling: your name and mark in place of ours. It is separate from your organization's Name on the same page, which every plan can set — that one names your company on your invoices and in your audit log, and it does not change what the product calls itself. On plans without branding the section is not shown at all.

Three things about it are worth knowing before you set it up.

It never appears outside your organization. Not on a sign-in page, not on a public link, not to anyone who is not a member. A chosen logo and company name rendered on our domain for a stranger is a phishing kit, so there is no surface where that can happen.

The support contact replaces ours only inside your console. Billing and account deletion keep PulsVault's contact, because those are between us and whoever holds the account — your helpdesk cannot cancel a subscription it does not own.

SVG logos are refused. PNG, JPEG, GIF and WebP up to 2 MB are accepted. An SVG is a script-carrying document, and this file is served from our own origin to everyone in your organization.

If your plan changes and no longer includes branding, nothing you saved is deleted — it stops being applied and comes back if the plan does again. You can still remove a logo on any plan.

The setup checklist#

The Rollout page has two tabs: Checklist and Developers. It opens on the checklist, which lists six steps and how many of them are done. The first step still open is shown above the list as Next up:

Step	Done when
Name the organization	You have renamed it from the one signup guessed off your email domain
Set up billing	A paid plan is in force
Invite your first colleague	Someone other than you is a member, or has a live invitation
Decide about two-factor authentication	You have turned "require 2FA for all members" on
Create an organization vault	At least one vault the company owns exists
Verify a domain	At least one domain has passed its DNS check

A step whose page needs a permission you do not hold — inviting people needs member management, billing needs billing access — says who can do it instead of linking you to a page you cannot open.

Nothing on this list is stored. Each line is worked out from your organization every time the page loads, so a step cannot stay ticked after you have undone the thing that ticked it.

CLI and pipeline commands#

The Developers tab prints the commands an engineer needs, with your API host and project already substituted:

• signing in on a workstation,
• pinning the default project so paths can be written short,
• checking the CLI can reach us and the key works,
• and a GitHub Actions step and a GitLab CI include that load secrets into a build.

Pick which project the commands are filled in for with the selector at the top of the tab; it fills in the CLI commands and the pipeline snippet together. The pipeline section switches between GitHub Actions and GitLab CI.

If your organization has no project yet, or you pick No project, the commands still show, with <your-project> left in place. Copying is turned off for the commands that contain it — a command that would silently paste a broken path is worse than one that visibly asks to be finished — while commands with no project in them, such as signing in, can still be copied.

These are generated from the CLI itself, so a flag that changes in the binary changes here too. The full command surface is in the CLI reference, and the guides that explain each area start at Reading secrets.

Inviting people#

Invitations are on People → Members. You can paste a list and invite up to fifty addresses at once; each address is reported separately, so one that is already a member or past your seat cap does not fail the rest of the batch. Invitations reserve a seat as soon as they are sent, which is what makes the cap mean anything.

Which addresses you may invite is decided by your invitation policy.

If someone signs up before you invite them#

Someone who creates a PulsVault account with an address on a domain you have verified is told that your organization is already here, and pointed at asking an administrator for an invitation. They are never added automatically. Joining an organization changes who administers an account, and that is not something an email domain gets to decide on someone's behalf.

Single sign-on and directory sync#

SAML, OIDC and SCIM are not available yet. Until they are, invitations are how people join.

Related#

• Roles & permissions — what an invited member can do once they arrive
• Domains & invitation policy — proving you own a domain
• Organization vaults & policies — vaults the company owns
• Audit logs — where the apply-to-all entry lands