Security policy
An organization’s security policy is about the session, not the person: how somebody signed in, how long ago, and from where. It is set by admins in the organization’s Security section, and every change asks you to confirm with a second factor.
What it can require
Section titled “What it can require”| Setting | What it means |
|---|---|
| Require MFA | The session was proven with an authenticator app or a security key. An emailed code, a recovery code or a remembered device does not count. |
| Require single sign-on | Somebody whose address is on one of the organization’s verified domains must have signed in through one of its enabled connections. A contractor on their own domain is not asked. |
| Allowed IP ranges | People reach the organization only from these address ranges. |
| API key IP ranges | Agents’ keys are accepted only from these ranges. |
| Maximum session length | Hours since sign-in after which the session ends. |
| Idle timeout | Minutes without activity after which the session ends. |
| Who creates API keys | Admins (default), or owners only. Only an owner changes this. |
| Audit retention | Days of audit trail to keep, 30 to 3650; empty keeps everything. |
How it is enforced
Section titled “How it is enforced”Access requirements (MFA, single sign-on, address ranges) close every path into the organization for a session that does not meet them — owners’ and admins’ included, and grants to outsiders too. The person sees a sentence naming the organization and what it requires; their own space and every other organization are untouched.
Session limits apply to the whole sign-in, because one session serves every organization a person belongs to: the strictest of their organizations applies. A session past it is ended and they sign in again.
A member of an organization requiring MFA who has a strong factor is not let through by a remembered device: they are asked for it, so their session qualifies.
Saving safely
Section titled “Saving safely”A policy that would refuse the session saving it is itself refused: you cannot lock yourself out by saving. Turning Require single sign-on on needs a verified domain and an enabled connection first.
Break-glass
Section titled “Break-glass”When single sign-on is required and the identity provider is down or misconfigured, an owner who signs in with an authenticator app or security key of their own still gets in. Not an admin, not an emailed code. Each use is recorded in the audit trail and emailed to the other owners.