What are these emails from UprootSecurity, and do I need to act on them?
UprootSecurity sends a short, fixed list of emails and nothing else. Two of them land every Monday morning (UTC) — one on your whole test suite, one for each person who owns tests — and the rest are triggered by something specific. Most are informational. Three ask someone to act: the orphaned-account alert, where a person who has left still holds live accounts in the tools you've connected; the account-setup mail a new person gets; and the evidence export link, which expires after 48 hours. Email is our only channel right now.
Every email we send
When it arrives | Who gets it | Do I need to act? | |
|---|---|---|---|
Weekly compliance summary — where your whole suite stands | Monday morning, UTC | Your organization's Owner | No. Read it and move on |
Weekly digest of the tests you own | Monday morning, UTC — same run, separate email | Every person who owns at least one test that changed in the past 7 days | No — but the failing tests it lists are yours to fix |
Role changed — someone's role moved in a connected tool | Monday, early morning, as a weekly batch | Whoever you've configured; your organization's Owner by default | No, unless the change looks wrong to you |
Orphaned account — a deactivated person still has access | When it's detected, after someone is deactivated here | Whoever you've configured; your organization's Owner by default | Yes. Remove those accounts in the tools it names |
Account setup — the mail that lets a new person set a password | When a person is added to your organization | That person | Yes, by them — the link is short-lived |
Password reset, and the confirmation once it's changed | On request, then on change | That one person | Reset: yes. Confirmation: only if they didn't ask for it |
Evidence export ready — the download link for a bundle you asked for | When an audit evidence export finishes building | Whoever requested it | Yes, within 48 hours — the download link expires |
The two Monday emails
The compliance summary is your posture at a glance: how many tests you have, how many are passing and what share of the total that is, how many are failing, and what moved in the past seven days — tests that started passing, tests that started failing. A week where nothing moved says exactly that. If you have no tests being monitored yet, we skip the email rather than send you an empty one.
The digest of the tests you own is a different mail with a different audience. It goes to each test owner individually, and it covers only their tests: how many they own, how many passed, failed and are still pending, then a short list. Two people can get very different digests on the same morning.
You don't sign up for that digest and you can't opt out of it. If you own a test that changed, it's coming. The only lever is ownership itself — see owners and assignment.
There's no email when a single test fails. The Monday digest is how a failing test reaches you, by design. If you're waiting on something faster, it isn't on its way.
The two access alerts — and why the role-change one isn't instant
The role-change alert reads as real-time and isn't. Role changes in your connected tools are picked up by a weekly sweep, and everything it finds arrives in one early-Monday batch. A role that changed on Tuesday reaches you the following Monday. Treat it as a weekly review, not an alarm.
The orphaned-account alert is the one worth stopping for. It fires when someone is deactivated in UprootSecurity after being removed from your identity provider, and they still hold live accounts in tools you've connected. The email names the person and lists which tools still have them. The fix is at the source: go into each of those tools and remove the account. UprootSecurity doesn't close them for you.
That alert is also the reason to off-board people in your identity provider rather than switching them off by hand here — how people get access covers the difference.
The evidence export link is good for 48 hours
Request an audit evidence export, and we email a download link to you once the bundle is built. The link expires 48 hours after it's sent. Past that, request the export again — there's nothing to extend or resend.
What you can change
Only the two access alerts — role changed and orphaned account — and only who receives them.
Open People Access → Settings → Notification Setup and add a person, or one of the groups you've built in People Access, as a recipient. You need Owner or Administrator access to change it.
Removing every recipient is the only way to switch one of these alerts off. There's no on/off control — an alert with nobody listed simply doesn't send.
What you can't change
- The two weekly emails. They aren't configurable and they don't appear in that settings screen.
- Timing or frequency, on anything we send.
- There's no unsubscribe link and no personal preference screen. If someone wants off a list, an Owner or Administrator removes them as a recipient — and for the two weekly emails, that isn't possible today.
- Email is the only channel. Nothing is delivered anywhere else.