Skip to main content
Infisical is structured around organizations and projects.

​
Organizations

An organization represents a company or high-level entity (e.g. Acme Corp) and acts as the root scope for managing members and machine identities, projects, usage and billing, global integrations and configuration (such as single sign-on, provisioning, etc), and more. Within an organization, you can create any number of projects—each tied to a specific product type such as Secrets Management or PKI that determines the functionality available.

​
Sub-organizations

Large enterprises may need to create sub-organizations to segment by business unit, delegate administration, and maintain clear boundaries between teams. Each sub-organization works like a regular organization with its own projects and settings, while sharing authentication and billing with the root organization.
Sub-organizations is a paid feature available under the Enterprise Tier.

​
Projects

Selecting a product on the organization overview opens the projects of that type. My Projects lists the ones you’re a member of. Organization admins also get an All Projects tab, which lists every project of that type in the organization, including the ones they haven’t joined. Selecting Join as Admin on a project there adds them to it as an admin, with full visibility and control.

​
Roles and access control

The Access Control section lets you view and manage roles and permissions for users, machine identities, and groups across your organization. Users are invited to an organization and assigned organization-level roles such as Admin or Member. You can also define custom roles at the organization level to fit your permission model. Infisical supports user identities (representing people) and machine identities (representing services, CI/CD pipelines, or agents). The same roles and permissions can be applied to either type of identity. To manage access at scale, Infisical also supports user groups — roles assigned to a group apply to all of its members automatically. Note that Infisical distinguishes between organization-level and project-level access control:
  • Organization-level access control: Roles and permissions governing access to organization-level resources and controls such as billing, member management, and identity provider configuration.
  • Project-level access control: Roles and permissions governing access to resources and workflows within a specific project (e.g., secrets, certificates, KMS keys).
To learn more about how permissions work in detail, refer to the access control documentation.
Infisical provides immutable roles such as admin and member for free.If you’re using Infisical Cloud, the ability to create custom roles is available under the Pro Tier.If you’re self-hosting Infisical, then you should contact sales@infisical.com to purchase an enterprise license to use it.

​
Usage & billing

The Usage & Billing section provides an overview of your organization’s billing information and platform usage. Infisical calculates usage at the organization level—aggregating activity across all projects and product types (e.g., Secrets Management, PAM, PKI). From this tab, you can track usage, view billing details, and manage your Infisical Cloud subscription.

​
Audit logs

Infisical provides a unified view of audit logs at the organization level. All platform activity—including secret access, certificate issuance, platform logins across the organization —is recorded and searchable in a central log view. Audit logs are also viewable at the project level, where they’re scoped to show only events relevant to that specific project. This allows project administrators to monitor activity and investigate changes without requiring organization-wide access. The External Log Streams tab on the same page forwards audit events to third-party logging tools like SIEMs or cloud storage. See audit log streams.

​
Integrations

The Integrations section holds the connections an organization makes to third-party platforms, across three tabs. App Connections configures app connections to platforms such as AWS, GCP, and GitHub. Once configured, these connections can be reused across multiple projects as part of any feature that requires third-party integrations—such as secret syncing or dynamic credential generation. Workflow Integrations connects Slack or Microsoft Teams, so that events like access requests notify a channel. External Migrations runs a one-time bulk import of data from another platform. To learn more, refer to the app connections documentation.

​
Organization settings

The Settings section lets you configure global behavior and security controls for the organization:
  • General: Manage the organization’s name, slug, default role for newly invited members, and incident contacts.
  • SSO & Provisioning: Enable SAML, LDAP, or OIDC-based authentication for user login, and SCIM to provision and deprovision users and groups from an identity provider.
  • OAuth Applications: Register external platforms that request delegated access to Infisical on a user’s behalf.
  • Networking: Manage the gateways and relays that connect Infisical to private infrastructure.
  • Security: Enforce MFA and set how long a login session lasts.
  • Encryption: Integrate with external KMS systems or bring your own encryption keys (BYOK).
  • Project Templates: Define default environments, roles, and settings to standardize project creation.
  • Product Settings: Configure organization-wide policies and templates for a single product, such as Secrets Management.
  • Sub Organizations: Create and manage child organizations under this one.