This article summarizes the permission design that administrators (Owner / Team Admin) set up when using Dive across multiple companies, factories, and departments, along with the routine tasks they perform to keep operations running.

For deciding whether to combine contracts (teams) into one or keep them separate, see Pros and cons of combining multiple companies or organizations into one team (contract unit). For the initial setup when you combine them into one team, see Initial setup and notes for operating across multiple departments.

Prerequisites: how teams, groups, and folders relate

Operating across multiple organizations is determined by a combination of the following three units.

Team: The contract unit. It represents the whole company, and only one exists in Dive. Different teams have completely independent SOPs, users, permissions, plans, Security Settings, and Usage Reports.
Group: A unit within a team, such as a department, section, or project. Groups can be arranged in a hierarchy (e.g., Manufacturing Department → Manufacturing Section 2), and one user can belong to multiple groups. The number of groups you can create and the depth of subgroups depend on your plan (see the next section).
Folder: Where SOPs are stored. For each folder, you specify which groups can access it. Members of those groups and of the groups under them can access the folder. You can also specify separately which groups can edit within the folder, so you can split access so that some people can view but not edit.

In short, you decide "who" by group and "what" by folder. Even when spanning multiple companies or sites, you design the scope of visibility along these two axes.

Plan restrictions

Operating across multiple companies and factories is affected by how many groups you can create and how deeply they can be nested. Please check these before you start designing.

Groups: You cannot create groups on the Free and Lite plans. The Core plan allows up to 5 groups, and the Pro and Enterprise plans have no limit.
Subgroups (group hierarchy): The Core and Pro plans allow one level of nesting (e.g., Manufacturing Department → Manufacturing Section 2). Deeper hierarchies are available only on the Enterprise plan.
Guest invitations: Available on the Core plan and above. You can invite up to three times your number of accounts, and these guests are counted separately from accounts with the roles Owner through View-only user.
Approval workflow: Available on the Pro plan and above.
Single sign-on and making two-step verification mandatory for all users: Enterprise plan only.
IP address restriction and Password policy: Available on all plans.

You can also check the limits available under your current subscription from the [Profile] icon in the upper right of the screen, then [Subscription, estimates & orders], then the [Subscription information] tab.

How to assign permissions

When spanning multiple companies or sites, the first thing you need to decide is who will hold the Owner role.

Owners and Team Administrators can access all folders in the team regardless of the Access Restriction Settings. If you combine multiple companies into one team, a person from any one of those companies can view all SOPs, including those of the other companies. If there are SOPs you do not want other companies to see, you need to split them into separate teams.

When you operate within one team, it is easier to manage if you hold roles at the following two levels.

Owner / Team Admin: Concentrate this role in one department, such as Quality Assurance or Production Engineering. Operations related to Security Settings, audit logs, and the subscription require this permission.
Group Administrator: Assign one for each site or department. They are responsible for adding users to their own group, creating folders, and approvals.

Because folder access restrictions follow the group hierarchy upward (to the parent group), simply belonging to a higher-level group does not let you open folders published only to the groups beneath it. If you have someone who views several sites together, either have them belong to each subordinate group one by one, or enable [Folder view scope] under [Business rules] in Owner Functions (disabled by default). When enabled, people in the selected roles (Group Administrator and above, Created user and above, View-only user and above) can also open folders for subordinate groups. For details, see Enabling viewing of folders for subordinate groups (Folder view scope).

Conversely, if you do not want SOPs in folders narrowed down by a higher-level group, such as headquarters, to be shown to people at subordinate sites, enable [Do not show SOPs in folders narrowed down by a higher-level group to people in lower groups] in the same section. People at subordinate sites can still open the higher-level folders to reach their own site's folders, but the SOPs placed there will not be displayed.

Set people who create SOPs as Created user, and people who only view as View-only user. Avoid giving higher-level permissions to too many people. For the operations allowed for each permission, see User permissions and number of accounts.

When spanning multiple sites or companies, a commonly used option is the "Groups that can also edit" setting in the folder's access restrictions. This lets you narrow down, among the groups allowed access, which ones can actually edit. For example, you can show another site's SOPs as reference while allowing editing only by that site's staff (Owners and Team Administrators can always edit).

Operating when teams are separated

If you keep separate teams (contracts) for each factory, department, or company, each team is completely independent. For operations, please keep the following points in mind.

What you can do

Allow mutual viewing: By inviting each other as guests to the other team, you can view folders continuously on a per-folder basis. Available on the Core plan and above. For details, see What is a guest invitation?.
Share a single SOP: When you issue an external sharing URL, people can view one SOP without logging in. The differences are explained in External SOP sharing: a guide to choosing the right option.
Work across both teams with one account: One account can belong to multiple teams and switch between them. This is also how headquarters administrators view each company's team. For steps, see Switching teams (when you belong to multiple teams).

What you cannot do

You cannot co-edit SOPs in another team. People invited as guests can only view.
You cannot move SOPs or video materials to another team. Even if you split or combine teams later, existing SOPs cannot be carried over, so decide on your units before you start operating.
You cannot view users and usage across multiple teams in one place. Periodic audits and checking the Usage Report must be done for each team.

Routine tasks for administrators

As the number of users grows, checking that the settings still match the current situation matters more than the settings themselves. Below, we have organized the tasks that customers actually running Dive perform, by frequency.

Monthly

Add users for new hires and transfers, and update their Group Affiliation. If there are many people, you can also bulk import from Excel.
Disable users who have left or transferred. Disabling a user frees up space in the Number of accounts, which can then be assigned to the next person. Usage history is kept, and the account can be restored later.
Check the external sharing URLs you have issued, and disable any that are no longer needed.

Quarterly

Compare the User list with your personnel data and check that no one who has left remains on the list.
Export the audit log as CSV and keep it as an internal operations record. The log records logins, adding and deleting users, permission changes, changes to Security Settings, and issuing or disabling external sharing URLs. Only Owners can export it. For steps, see Export the audit log as CSV.
Review whether folder access restrictions keep up with organizational changes.
Use the Usage Report to find SOPs with very few views. Determine whether the content is out of date or whether the people it is meant for have not been informed about it.

Annual

Review SOPs in order of last updated date, oldest first, and check that they still match the work on the floor.
Check how many accounts you are using against your Number of accounts, and estimate the number of users for the next fiscal period. You can also increase the limit by adding Options.
Review your Security Settings. The list of setting items is summarized in Overview of Security Settings (Owner Functions).

Decisions to make before rollout

These are items that are hard to change once the number of users has grown. If you decide them before adding sites or companies, there will be less work later.

Group hierarchy: First define groups based on your current organizational structure, then add cross-organizational projects as separate groups if needed.
Folder structure: If you think in three layers, "Company-wide," "Shared by site/department," and "This section only," reassigning people when they transfer will be kept to a minimum. Copying the organization chart as-is means rebuilding folders every time the organization changes. Also, if access restrictions are set on both a higher-level folder and a lower-level folder, only people who belong to both of those groups can access them. Set restrictions only at the levels where they are needed.
Naming rules: Simple rules are fine, such as site codes or process names. Renaming hundreds of SOPs later is a heavy task.
Checks before publishing: The Approval workflow (Pro plan and above) can be set up as "Company-wide" or "By group." Once configured, approval from the designated approvers is required when SOPs are issued or revised. Approvers can be specified by conditions such as the administrator higher up as seen from the initiator, the administrator of a specific group such as quality assurance or safety management, or the holder of a qualification. If you want to show drafts to stakeholders and get comments before publishing, you can also use Draft Sharing.
Starting point for transfers and departures: Relying on reports from the floor leads to missed changes. It is more reliable to send the monthly personnel list to the administrator. On the Enterprise plan, you can automatically sync the roster from an HR system or Microsoft Entra ID, and transfers and departures are reflected in Dive automatically (Automatically sync the roster from an HR system (SCIM)).
Security Settings: IP address restriction, Password policy, and the external sharing prohibition setting are available on all plans. Single sign-on (Microsoft Entra ID / SAML 2.0) and making two-step verification mandatory for all users are available only on the Enterprise plan. Applying these after the number of users has grown takes effort, so we recommend deciding on them before rollout.

Frequently asked questions

Can I separate what administrators can see by company within one team?
No. Owners and Team Administrators can access all folders within the team. If you need each company's management to be closed off from the others, please subscribe with separate teams.

Can I split or combine teams later?
You can add teams, but SOPs and video materials that have already been created cannot be moved to another team. If you need to migrate, you will need to create them again.

Do staff from group companies use up accounts when invited?
If they only need to view, please use guest invitations. Guest invitations allow up to three times your number of accounts, and they are counted separately from accounts with the roles Owner through View-only user. If they also need to create or edit SOPs, you need to add them as regular users.

Some floor staff do not have an email address.
You can issue an "Email-free account" that logs in with a Login ID.

Related information