Comments & collaboration

Comments let your team discuss the work in context — right where the work lives. You can comment on findings, assessment questions, remediation tasks, risk-register entries, vendors, and policies. Every thread behaves the same way no matter where it appears.

Posting a comment

Open the item (a finding, a remediation task, or a question in an assessment) and find its Comments section. Type your note and post it. On an assessment question you can also press c while the question is focused to jump straight to its comment box.

Comments are scoped to your organization — only members of your org can read or post them, and the same applies to anyone you mention.

Mentioning a teammate

Type @ and start typing a name to mention a colleague. Pick them from the list (or finish typing @first.last). When you post, the person you mentioned gets an in-app notification linking straight back to the comment, so nothing gets lost in a long thread. You can only mention active members of your own organization.

Mentions are a personal, direct signal, so they always notify — they aren't muted by the general comment-notification preference.

Editing and deleting

You can edit or delete your own comments at any time. An edited comment shows a small "· edited" marker so the history stays honest. Org admins can also delete anyone's comment for moderation. Deleting is permanent.

Live updates

Open threads refresh automatically — if a teammate adds a comment while you're looking at the same finding or task, it appears within a few seconds without a page reload. (Updates pause while the browser tab is in the background.)

Auditors

Users with the read-only auditor role can never post, edit, or delete, so the collaboration record stays intact and reviewable during an audit.

What they can READ is narrower than the register list suggests, and follows the same scope as the owning page rather than the comment system:

• Threads on a record type covered by the auditor link's granted scopes are readable. A findings-only grant reads findings threads and nothing else.
• Remediation threads are refused to every auditor, regardless of grant. Remediation is not one of the scopes an auditor link can grant, and the remediation register itself refuses auditors outright.

Contributors are scoped too: on a finding, a contributor reads the thread only where the finding is assigned to them, matching what the findings page shows.

Where comments show up

A question that has comments is flagged in the assessment so you can filter to Has comments and pick up open discussions quickly.