Administration
Security
Sign-in alerts, lockouts, refused requests and two-factor coverage for your company, with what to do about each.
Security is the owner's watch on how people sign in. It turns the sign-in and access entries in the audit log into a short list of things that need a person: someone locked out, repeated wrong passwords, someone reaching for screens their role does not open, a sign-in from a new place, or a missing second factor. Each alert says what to do.
- Where
- Administration → Security (/security)
- Who can open it
- Users · view. By default: the Owner only
- Reads
- The last 30 days of sign-in and access entries in the audit log
- Saves
- Nothing. The remedies are on Users and Roles
What you see
Figures
| Figure | Meaning |
|---|---|
| Open alerts | How many alerts need attention. Red when any is High |
| Failed sign-ins | Wrong passwords or codes in the last 7 days |
| Refused requests | Pages or saves refused for lack of permission in the last 7 days |
| Two-factor | The share of people with two-factor on ("N of N people") |
A Full audit log button in the header opens the Audit log.
Needs attention
| Column | Meaning |
|---|---|
| Severity | High, Medium or Low |
| Alert | What happened, with the remedy underneath |
| Who | The person or the name that was typed |
| When | The latest occurrence, or "Now" for a current state |
With nothing to act on: "Nothing needs attention · No lockouts, repeated failures or new sign-in addresses."
Recent sign-in and access events
The 50 newest entries, with a count of sign-ins in the last 7 days.
| Column | Meaning |
|---|---|
| When | Date and time in your company's time zone |
| Who | The person |
| Event | Signed in, Sign-in failed, Sign-in refused, Two-factor set up, Request refused or Portal sign-in |
| Detail | What the entry recorded |
| Address | The network address it came from |
The alerts
| Alert | Raised when | Severity | What to do |
|---|---|---|---|
| Sign-in paused after repeated wrong passwords | An account is locked right now | High | It lifts by itself in 15 minutes. If the person was not trying to sign in, reset their password |
| N failed sign-ins in the last day | 3 or more failed sign-ins for one person in 24 hours | Medium; High at 10 or more | Ask the person whether it was them. If not, reset their password and sign them out everywhere |
| N refused requests in the last day | 5 or more refused pages or saves for one person in 24 hours | Medium | They are reaching for screens their role does not open. Check the audit log; adjust their role or ask why |
| Signed in from a new address | A sign-in in the last 7 days from an address the person has not used in the previous 30 days | Low | Usually travel or a new network. If the person does not recognise it, reset their password |
| Two-factor sign-in not set up yet | An active person whose role requires two-factor has not set it up | Medium | Their role requires it; they will be asked to set it up at their next sign-in |
High alerts are listed first.
The protections behind it
| Protection | How it works |
|---|---|
| Lockout | 5 failed sign-ins for one account, or 20 from one network address, within 15 minutes pauses sign-in for 15 minutes |
| Reset links | At most 3 per account and 20 per address per hour. A link lasts 60 minutes |
| Passwords | 8 to 128 characters, with a capital letter and a digit, and not a common password. Stored with argon2id |
| Two-factor | Required for the Owner and Finance Manager roles. Each six-digit code works once only |
| Sessions | 12 hours, or 30 days when "remember me" is ticked. Deactivating a person or resetting their two-factor ends every session |
| Refused requests | Every page or save refused for lack of permission writes a security.access_denied entry |
| Audit log | Append-only. Nobody, including the owner, can edit or delete an entry |
Acting on an alert
The fixes live on other screens:
- Reset a password or Reset two-factor: the person's menu on Users.
- Deactivate someone: also on Users. They are signed out everywhere at once.
- Change what a role can reach: Roles & permissions.
- See the full trail: Audit log, filtered to the person.