Set your organization's sign-in rules and see its sessions

An Owner sets how members of the organization sign in, and sees where each member is signed in, on Settings, then Security. On a phone, Settings is under More.

Sign-in rules

• Two-factor sign-in for everyone. Turn it on in the Two-factor sign-in card. In Sign-in rules you can give members who have not set it up 7, 14 or 30 days to do it. Each of them is emailed a reminder once a day until they have, or the time runs out. After that, ContactRoll asks them to set it up before anything else.
• How long a session lasts. Choose 8, 12 or 24 hours, 3 days, a week, two weeks or 30 days. A member signed in longer than that is signed out and signs in again. Counted from when they signed in.
• The IP allowlist, on the Plus plan. List the addresses, or ranges such as 203.0.113.0/24, that members may sign in and use ContactRoll from. Anyone elsewhere is told they are not at an allowed address. The list is saved only if it holds the address you are at now, so you can't shut yourself out. ContactRoll support, when you let it in, is not held to the list.

Press Save the sign-in rules. They apply from each member's next request.

Active sessions

Under Active sessions you see each member's sessions: the browser and computer or phone, the approximate country, when it signed in and when it was last used.

• Sign out ends one session. That device asks for the password again.
• Sign out everywhere ends every session of that member.

Every member sees their own sessions, and can sign out any of them, on Settings, then Sign-in and security.

Sign-in alerts

• When a member signs in on a device or from a country they have not used in the organization in the last 90 days, ContactRoll emails them, and it is in the audit log.
• When five or more passwords are refused for a member's account within 15 minutes, the Owners get a security alert.

Downloading reports

Downloading a report as a file is a permission of its own, Download reports. Owners and Administrators have it. An Owner can give it to other roles on Settings, then Roles. Every download is in the audit log.

How long the audit log is kept

On Settings, then Audit log, an Owner or Administrator chooses 90, 180 or 365 days. On the Plus plan the log can also be kept for 2, 3 or 5 years. ContactRoll deletes older entries each night.