Overview

Organizations are groups of Mode users that can securely share database connections and analysis with each other. You may be a member of any number of organizations. By default, any member of an organization can query any of the organization’s private database connections.

Anyone with a Mode user account can create an organization for free.

Managing membership

Roles

You can see all the current and former members of your organization, as well as their current role, from the Members page in Organization Settings:

  1. Navigate to the Mode home page and click on your name in the upper left corner of the window.
  2. Click Organization Settings
  3. In the People section click Members

All organization members will be listed on the right, grouped into tabs according to their role:

  • Admins - Can remove members from the organization and grant Admin access to Full Members. They can create new database connections and query and manage settings for all database connections. Only admins can change many organization settings, including those related to member authentication. We recommend larger organizations have several admins.
  • Full Members - Can create, view, and edit reports. Full members may create new database connections. They have query access to all of the organization’s database connections that are not limited and any limited database connections which they have been granted access to by an admin or that connection’s creator. By default, new members join as full members. By default, members join as full members.
  • Pending Members - They have been invited to join the organization and are pending their acceptance.
  • Former Members - Have been removed from the organization by an admin. These users no longer have access and cannot rejoin unless an admin re-invites them.

Change the role of a member

You must be an admin to change a member’s role in your organization:

  1. Locate their name in the Members section in Organization Settings, in either the Admins or Full Members tabs depending on their current role.
  2. Click on the menu-dots-gray-press Created with Sketch. button at the end of their row.
  3. In the drop down menu, select one of the following options:
  • Make Admin: Grant admin rights to a Full Member.
  • Remove Admin: Removes admin rights from a member, making them a Full Member.

Add a member

Invite a new member

By default, any member of your organization can invite new users to join. Invitees are required to verify their email address before being allowed to join the organization. Invitations expire after seven days.

  1. Navigate to the Mode home page and click on your name in the upper left corner of the window.
  2. Select Invite to Mode from the dropdown menu.
  3. Enter the email address of the person you want to invite and add an invite message.
  4. Click Invite.
  5. You can see the status of your past invites—as well as resend pending invites—by clicking See the invites you’ve already sent.
Resend an invitation

You can see the invites you’ve already sent and resend invitations to users from Organization Settings:

  1. Navigate to the Mode home page and click on your name in the upper left corner of the window.
  2. Click Organization Settings
  3. In the People section, click Sent Invites.
  4. Click on the names of invitees who have signed up to see their profiles. To re-invite someone who hasn’t signed up for Mode yet, click the Resend button next to their name.
Reinvite a former member

To reinvite a former member of your organization:

  1. Locate their name in the Members section in Organization Settings, in “Former members & requests”.
  2. Click on the menu-dots-gray-press Created with Sketch. button at the end of their row.
  3. Select Reinvite to org
  4. The user will receive an email invitation that they must accept before being granted access to the organization again.

Remove a member

You must be an admin to remove a member from your organization:

  1. Locate their name in the Members section in Organization Settings, in either the Admins or Full Members tabs depending on their current role.
  2. Click on the menu-dots-gray-press Created with Sketch. button at the end of their row.
  3. Select Disable Membership: to revokes that member’s access to the organization.

IMPORTANT: Removing a member from your organization does not remove any reports or other assets they created.

Groups

Groups allow organization admins to easily modify and control access to database connections and Collection membership for logical clusters of members with similar needs (e.g., departments, project teams, etc.).

To create a new group or manage members of an existing group:

  1. Navigate to the Mode home page for the organization where you would like to create the group.
  2. Click on your name in the upper left corner.
  3. Click Organization Settings from the dropdown menu.
  4. In the People section, click Groups.

All of the groups in your organization will be listed on the right. Admins can perform the following actions:

Create a new group
  1. Click Create Group.
  2. Enter a name for your group and click Create.
  3. Find the organization members in the list that you want to add to the group and click Add next to each one.
  4. When you are finished adding members, click Done.
Add or remove members
  1. Hover over the group in the list and click Members.
  2. To add new members to the group, click on Add Members. Find all members you want to add in the list and click Add. When you are finished, click Done.
  3. To remove a member, hover over the name of the member you want to remove and click Remove Member.
Delete a group
  1. Hover over the group in the list and click on it.
  2. Next to the group’s name, click on the gear settings-mini-hover Created with Sketch. .
  3. Click Delete.

Notifications

Organization admins can elect to receive emails from Mode when new users sign up, organization membership changes, and more:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Click My Email Notifications.
  3. Toggle the notifications that you want to receive on or off.
  4. Click Save settings.

Restricting invitations

Admins in Mode’s paid plans can control and restrict the onboarding of new members:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. In the People section, click on Member Authorization.
  3. Click on the Member Permissions tab.
  4. On this tab, you will see a number of options to help you control how new members can join your organization:
Who can invite new members?
  • All Members: (Default) Any existing member can invite new users to the organization.
  • Only Admins: Only admins can invite new users to the organization.
What should happen when someone with a yourdomain.com email address signs up for Mode?

This setting will only be visible if your organization has claimed a domain.

  • Approve Automatically: (Default) Any new user with a verified email address in the indicated claimed domain will automatically become a member of the organization when they sign up for Mode.
  • Require Approval: An admin must approve each new member after they are invited to join the organization.

Claimed domains

When an organization gets created by a user with a verified email address in a domain that is new to Mode, that organization will “claim” the domain of the email address. Any subsequent users who sign up for Mode with a verified email address in the claimed domain will be automatically added to the organization that claimed the domain. Once an organization claims a domain, no subsequent organization can claim the same domain.

This is designed to create a streamlined onboarding process for new Mode users who work at the same company as the first user who signed up for Mode and created an organization with their work email address

How claimed domains work

For this example we’ll use a fictitious company called Octan Industries. All employees at Octan Industries have an email address ending in @octan.com.

Ann works for Octan industries and has the email address ann@octan.com. She signs up for a Mode account and is the first user with an @octan.com email address to do so. She verifies her email address and creates a new Mode organization. The Octan organization will automatically claim the @octan.com domain.

Later, when bill@octan.com signs up for Mode and verifies his email address, he will be automatically added to the Octan organization and can collaborate with Ann in Mode.

Contact our support team to claim a domain.

IMPORTANT: Some domains are not available to be claimed. For example, they may belong to a large institution and require additional authorization, or they may be shared email domains used by many organizations. In such cases, we encourage customers to use email invites or a third-party identity provider to set up user accounts in Mode.

Privacy and Security

Report visibility

Everyone on the internet can access your Mode organization’s public profile page (e.g., https://app.mode.com/modeanalytics) as well as the reports in your organization’s community Collection. In addition, all Mode users can access any data uploaded by members of your organization to Mode’s Public Warehouse.

Any other report in your organization, including it’s code and query results, is only visible to other members of your Mode organization unless someone has explicitly enabled external sharing for that report.

GDPR

Mode is committed to meeting the requirements of the General Data Protection Regulation (‘GDPR’). The GDPR is a landmark EU data privacy law, effective May 2018, which affects both European and non-European businesses. Learn more about Mode’s GDPR readiness, security infrastructure, and subprocessors.

Mode offers a Data Processing Agreement (DPA) and EU Model Contract Clauses as a means of meeting the adequacy and security requirements of the European Parliament and Council of the European Union’s Data Protection Directive and the GDPR. Mode’s DPA is available to all organizations using Mode and is automatically incorporated in the Terms of Service. The DPA can be found here.

Authentication and SSO

Restricting sign-in methods

Organization admins can set sign-in restrictions to control how members are able to authenticate when accessing their Mode organization.

  1. Navigate to the Mode home page.
  2. Click on your name in the upper left corner.
  3. Click Organization Settings from the dropdown menu.
  4. In the People section, click on Member Authorization.

By default, users can log into your Mode organization with all of the following methods of access. Toggle off any methods that you do not want to allow users to authenticate with:

  • Username and password
  • Google
  • Slack
  • Office365
  • SAML provider of your choice (if configured)

WARNING: Do not disable all sign-in methods. If all methods are disabled it will be impossible for anyone to sign-in to your organization, including admins, and you will need to contact our success team for assistance.

Custom SAML

Admins may define one more more custom SAML identity providers that your Mode organization can use to authenticate users:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. In the People section, click on Member Authorization.
  3. To add a new SAML provider, click + Add New Provider. To edit or delete an existing provider, click the gear settings-mini-hover Created with Sketch. next to it in the list and click Edit or Delete.
  4. Enter the SAML configuration and click Update when you are finished.

SCIM

SCIM is a protocol that lets enterprise identity providers (IdPs) integrate with and provision applications. This allows large organizations to keep all of their applications up to date with their org chart and maintain centralized control of app and data permissions.

Once you are integrated through SCIM, you will be able to provision users into Mode and manage Mode group memberships through your IdP, rather than needing to do it within the Mode UI. This allows you to manage Mode from the same place and in the same way that you manage other applications, and synchronize identity information like name and email across all of the apps that your members use.

The effect is a less tedious workflow for application administrators, resulting in tighter security and a more effective and accurate deployment of Mode into your org.

Note: Ideally, a SCIM API is agnostic to which IdP an organization uses. But each IdP has small quirks in their implementation so we will release support for one IdP at a time. We are starting with Okta, but will be releasing support for additional IdPs in the future.

Supported Features

The following provisioning features are supported:

  • Push New Users: New users created through OKTA will also be provisioned in Mode.
  • Push User Deactivation: Deactivating the user through OKTA will remove the user from the organization and all groups in Mode. If they are reactivated they will need to have any groups reassigned to restore associated resource entitlements.
  • Push Profile Updates: Updates made to the user’s profile through OKTA will be pushed to the third party application. First Name and Last Name will be combined as the Full Name in Mode.
  • Group Push: Groups and their members can be pushed to Mode. You can find more information about using group push operations here: Using Group Push.
  • Reactivate Users: Reactivating the user through Okta will reactivate the user in Mode. They will need to have any groups reassigned to restore associated resource entitlements.

Import Users, Import Groups, and Sync Password are not currently supported.

Requirements

Mode requires that SCIM customers have completed the SAML setup process and have a working Okta-Mode integration before setting up provisioning features with SCIM. Organizations wishing to use SCIM are required to use SAML as their sole signin method.

Attributes and Mappings

Mode supports users pushed from Okta with Okta mastering the userName, givenName, familyName, email, and emailType attributes. Mode uses only the user’s primary email internally. While Mode accepts any userName, we recommend that this attribute be set to the primary email (the Okta default).

Mode-mastered attributes are only supported in the initial SCIM setup and matching process.

Mode supports designating admin users via specifying admin as the value of the role attribute. Other values for role will be ignored.

Specify admins in Okta to ensure users retain their Mode roles. To see who is currently an Admin, go to Organization Settings > Members in Mode.

Attribute Mappings Screenshot

Users and Groups

Mode supports Group Push with Okta, which allows admins to push groups from Okta to Mode, as well as manage groups that were created in Mode through Okta.

Note: Users need to be assigned to the Mode application before they will be included in pushes of Groups that contain them.

For more information on Group Push, see Okta’s documentation on Using Group Push and Enhanced Group Push.

Session expiration

By default, logged-in sessions to Mode expire after 30 days, at which point users must re-authenticate. If you are an admin and would like to adjust the session expiration length for your organization, please contact us.

Sharing and embedding

Sharing

Admins can control how members of their organization are able to share reports both internally and externally:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Click on Sharing & Embedding under Features.

Adjust the toggles next to each of the following options and click Save settings when you are done to confirm:

Allow External Sharing of reports

Disabled by default. External sharing must be enabled in Organization Settings before anyone can share reports outside of your organization. Enabling external sharing in Organization Settings will not cause any reports or data to be shared; external sharing must be enabled for each individual report.

Disabling this setting will immediately cause all external links to all reports in your organization to stop functioning and return a 404 - Not Found error. Any reports which previously had external sharing enabled will therefore become inaccessible to viewers who are not logged in members of your organization.

If you are an admin of Mode’s paid plan organization and you do not see the setting to enable External Sharing, it may not be included as part of your paid agreement. Contact our success team to learn more.

Allow data previews, PDFs, and CSVs to be included in emails and Slack messages

Enabled by default. When disabled, report image previews will no longer appear the message bodies of Slack or Email shares, and reports shared via email can no longer contain attached PDFs or CSVs.

Allow users to access and move reports into your organization’s Community space

Disabled by default. Enable to make the community Collection visible to all members of your organization and allow users to move reports into it. Hiding the community Collection will not delete reports already inside it. Reports already in the community Collection will still exist and will be available via URL or discoverable through Mode search. However, members will not be able to move any new reports into the community Collection.

Require transport encryption for emails

Disabled by default. Enable this feature to prevent Mode from being able to send emails related to your organization, such as when members share via email, to servers that don’t have transport encryption enabled.

Embedding

White-Label Embed signature tokens

You must use a valid signature token for your Mode organization to successfully generate a signature for a White-Label Embed URL. Signature tokens can only be created by an organization admin. To create or modify a signature token:

New signature token

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Click on Sharing & Embedding under Features.
  3. Click on the Embedding tab.
  4. To create a new signature token, enter a unique name and click Create token. The new token’s public access key and private access secret will appear.
  5. To rename or invalidate a signature token, click Edit next to it in the list.

WARNING: Remember to store the access secret securely. Do not expose the access secret on public sites, in client-side code, or in public code repositories.

Slack integration

The Mode Slack app enables members of your organization to share reports via Slack directly from Mode.

Installation requirements
  • You must be an admin of your Mode organization.
  • You must have an existing Slack workspace of which you are a member.
  • You must be authorized to install apps in that workspace.

Note: Reports can only be shared from Mode to any public channel or any private channel where the organization admin who connected Mode with Slack is a member. We recommend ensuring the admin who adds Mode to Slack is a member of all private channels where you’d like users to be able to share reports from Mode. For example, if Jane connects Slack to your Mode organization, but Jane is not in the private #sales-only channel, then no member of your Mode organization can share reports from Mode to the #sales-only channel.

Setting up
  1. Navigate to the Mode home page and click on your name in the upper left corner of the window.
  2. Click Organization Settings.
  3. Under the Features section, click Slack Application.
  4. Click the Add to Slack button.
  5. The Mode Slack app requires various permissions in order to function. Review these permissions and then click Authorize to complete the integration.

Now all members of your organization can share reports to your Slack workspace directly from the Mode interface.

Required permissions

Mode’s Slack app requires access to your team’s Slack workspace in order to facilitate sharing to Slack by members of your Mode organization. When you attempt to authorize Mode’s Slack app using your Slack account, Mode will request a number of permissions. Below is a list of these permissions, as well as some additional detail about what Mode’s Slack app does with each permission:

Slack permission oAuth scope(s) Why the Mode Slack App needs this scope
Confirm your identity identity.basic Verify that the user installing the Mode Slack App is a member of the target Slack workspace.
Access information about your channels channels:read groups:read Generate a list of channels (all public channels and any private channels the Slack App installer is a member of) that reports can be shared to.
View and attach previews for some URLs in messages links:read links: write Generate the custom unfurl, including the preview image, in the message that is posted to Slack when someone shares a report.
Access information about your workspace team:read Get the name and id of the Slack workspace for display in the Mode UI and for authenticating API calls.
View email addresses of people in your workspace identity.email Verify that the user installing the Mode Slack App is a member of the target Slack workspace.
Send messages as Mode chat:write:bot Post Slack messages to your workspace when someone shares a report via Slack in Mode.
Access your workspace’s profile information users:read Get the name of the installer of the Slack App to display in the Mode UI.

More information about Slack’s scopes can be found in Slack’s API documentation.

Channel access

Users in your organization can share reports to the following Slack channels:

  • Public channels in your connected Slack workspace
  • Any private channels in your connected Slack workspace where the Slack admin who connected Mode with Slack is a member
  • With Slack Connect, any shared channel created in the Slack workspace connected with Mode

For organizations on Slack’s Enterprise Grid, public & private multi-workspace channels will work as above when made available to the workspace connected with Mode.

Tip: Mode displays the name of the connected Slack workspace as well as the Slack username of the admin who enabled Slack sharing. Before trying to share a Mode report in a private channel, check that this admin is a member!

Colors and styling

Report themes

Your organization includes a number of built-in themes which you may be able to compliment with custom themes.

Add a custom theme
  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Under Features, select Colors & Themes.
  3. Click on the Report Themes tab.
  4. Click on the New Theme button.
  5. Enter a name for your theme. In the CSS box, paste or write the CSS for this theme. To import a hosted CSS file, you can use an @import statement (e.g., @import url("https://example.com/stylesheet.css")).
  6. When you are finished, click Save.

Any valid CSS can be included in a custom theme. While you cannot included any JavaScript in a custom theme, you can embed JavaScript in reports directly using the HTML Editor.

Manage custom themes

Any member can use or create a custom theme, however a custom theme can only be edited or deleted by it’s creator or and organization admin. You cannot delete any of the built-in color themes. To manage:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Under Features, select Colors & Themes.
  3. Click on the Report Themes tab.
  4. To modify a custom theme, locate it in the list and click on it. Make any changes and click Save.
  5. Click on the menu-dots-gray-press Created with Sketch. button next to a theme for additional options:
    • Set as default: Admins only. Set this theme as the default for all new reports. Does not impact any existing reports.
    • Delete: Deletes the theme.

Color palettes

Your organization includes a number of pre-defined color palettes which you may be able to compliment with additional custom color palettes.

Add a custom color palette
  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Under Features, select Colors & Themes.
  3. Click the New Color Palette button.
  4. Enter a unique name and select either Categorical or Divergent palette type:
    • Categorical: Used with most built-in charts (e.g., line, pie, bar, etc.). Input between 2 and 20 different color hex codes. After writing or pasting in a value (e.g. #37B067), press enter to confirm. Use the X button to remove the value.
    • Divergent: Used with Big Number visualizations. Input a color hex codes for each end of the color gradient.
  5. Click Save.
Manage custom color palettes

Any member can use or create a custom color palette, however a custom color palette can only be edited or deleted by it’s creator or and organization admin. You cannot delete any of the built-in color palettes. To manage:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. Under Features, select Colors & Themes.
  3. To modify a custom color palette, locate it in the list and click on it. Make any changes and click Save.
  4. Click on the menu-dots-gray-press Created with Sketch. button next to a color palette for additional options:
    • Set as default: Admins only. Set this palette as the default for all new reports. Does not impact any existing reports.
    • Delete: Deletes the palette.

Billing

To manage billing communications and view billing history:

  1. Navigate to the Mode home page, click on your name in the upper left corner of the screen and click Organization Settings from the dropdown menu.
  2. In the Organization section, click Billing.
  3. Here you’ll find of number of sections where you can view and modify your organization’s billing details:
Section What you can do
Overview Details about your paid Mode plan, including it’s renewal date.
History All invoices related to your paid plan.
Contacts View or modify recipients of all invoices and billing communications.
Payment method Modify the credit card information on that Mode has on file.

Eligible customers may elect to be billed by means other than credit card (such as by wire). Please reach out to your account manager or contact our success team for more information.

Seat overages

For any users beyond the number of included users in your Mode agreement, you will be charged a pro-rated amount for each user based on the number of days in the billing period (typically monthly) that the user was a member of your organization. For example, let’s assume the incremental cost of adding an additional member to your organization is $25/month:

Suppose you add a coworker to your organization 10 days into your monthly billing period and there are 20 remaining days in that month. Since the coworker was a member of your organization for 2/3 of the billing period, you will be billed 2/3 of $25 ($16.67) for their seat for the period. If you remove another team member the same day you would be billed for 1/3 of $25 ($8.33) for that member’s seat during the period.

Delete an organization

WARNING: Deleting an organization will remove all associated data, including public warehouse tables, historical runs and reports. This action cannot be undone.

Only an admin can delete an organization. To delete an organization:

  1. Navigate to the Mode home page and click on your name in the upper left corner of the window.
  2. Click Organization Settings.
  3. Select the Details tab.
  4. Click Delete in the lower right corner.
  5. Type the username of the organization in the text box and click Permanently Delete.

IMPORTANT: When an organization is deleted, all reports contained within that organization are automatically deleted and historical report run results are retained on Mode’s servers for 30 days. After 30 days, all of the organization’s report run results are automatically deleted from Mode’s servers. After an additional 30 days, these report run results are automatically deleted from Mode’s backups and cannot be recovered by Mode.

Last updated July 2, 2020