Org Panel > Security brings the organisation’s security settings together. Security admins can change them. Auditors can read them.
Policies#
- Require two-factor: members without two-factor must set it up before using the Org Panel.
- Password rules: set a minimum length and optionally require upper case, lower case, a number and a symbol. The rules apply when a member creates, changes or resets a password.
- Session timeout: signs members out after a period of inactivity.
- Failed sign-in limit: locks sign-in after repeated failures.
- Network allowlist: limits where people can sign in from.
What the network allowlist covers#
The allowlist applies to sign-in on the web and mobile apps and to the Org Panel. Mail clients that connect with IMAP or SMTP use app passwords and are not covered. The page shows your current address and an Add my IP button, and refuses to save a list that would lock you out.
Members#
The members table shows each person’s two-factor status, last sign-in, active sessions and whether they are suspended. From it you can:
- Sign out everywhere: ends all of the member’s sessions. Web sessions end within about a minute. App passwords are not affected.
- Reset two-factor: removes the member’s two-factor and passkeys. They set it up again at next sign-in. They are told by email.
- Remind members without two-factor: sends one reminder email, at most once every 24 hours.
Alerts#
Org Panel > Alerts lists events that need attention, such as a spike of failed sign-ins, a new administrator, two-factor turned off, a blocked message, a broken DNS record, seats nearly used, storage nearly full or a sign-in failure through SSO. Acknowledge an alert once handled.
Alerts are emailed to the address you set on the Security page, or to the Owner. You can also turn on a weekly digest that arrives on Mondays and summarises seats, two-factor coverage, open alerts and sign-in failures.