This guide has two parts. The first is for everyone: how to protect your own account. The second is for company admins: the sign-in rules for the whole workspace. For the machines your bots run on, see the Security checklist.

1. Your own account

Go to Settings › My account. Everything below is under Sign-in and security or Your data.

Two-factor authentication

With two-factor authentication, signing in needs your password and a code from an app on your phone.

Open Two-factor authentication.
Scan the code on screen with an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. If you cannot scan it, type the key shown into the app.
Save the recovery codes somewhere safe, such as a password manager. Use Copy the codes. You will not see them again.
Type the 6-digit code the app shows now, and click Activate.

To switch it off, type a code from your app under Code from your app, to turn it off and click Deactivate.

Recovery codes

You get 10 recovery codes when you switch on two-factor authentication. Each one signs you in once if you lose your phone. The Two-factor authentication page shows how many you have left. When you run low, click Make new recovery codes, save them, and confirm with a code from your app (Use these codes). The old codes then stop working.

Passkeys

A passkey signs you in with your face, fingerprint or device PIN, or a security key, instead of a code from an app. Nothing secret is kept by Automize, and a passkey only works on this site, so it cannot be phished.

Open Passkeys.
Give it a name under Name for the new passkey, such as "Work laptop".
Type your password, or a code from your app, and click Add a passkey. Follow your device's prompt.

After your password you can use a passkey instead of a code, or use one on its own on the sign-in page. Some older security keys only work after your password. The list shows when each passkey was Added and Last used; click Remove to delete one.

If your only way in is a passkey on one device, losing that device locks you out. Add a passkey on a second device, or switch on an authenticator app as well, which also gives you recovery codes.

Sign-in history

Sign-in history lists every sign-in attempt on your account, successful and failed, from a browser and from a bot. If you see one you do not recognise, change your Password straight away and tell your admin. Failures are kept for 12 months; successes are kept for good.

Export your data

Export your data downloads a copy of your personal data as a JSON file: your profile, emails, sign-in history, regional settings, processes, forms, submissions, wikis, reports, files, events, queues and bots. The file is also saved in your Uploads folder.

2. For company admins

These are under Settings › Security and Settings › Access control.

Sign-in policy

Require two-factor authentication: everyone must set up a second factor. People who have not get the Grace period you set; after it, they must set one up at their next sign-in. A grace period of zero refuses everyone who has not already set one up. Company admins must always use two-factor authentication.
Minimum password length: the platform already requires 12 characters and refuses passwords found in known data breaches. You can require more, not less.
Password expiry: 0 (the default) means passwords do not expire, as current guidance recommends. Set a number only if an auditor requires it.
Who can connect a bot: Any member or Company admins only. See Connect a bot.

People who sign in through your own identity provider (SSO) are not covered by the two-factor requirement. Enforce it in your identity provider.

Single Sign-On (SSO)

Google, Microsoft and Apple sign-in are open to everyone. For SAML or OIDC with your own identity provider, set the Email domain for enterprise SSO and the WorkOS Connection ID; people with that email domain are sent to your identity provider. Choose the Default role for SSO users who sign in for the first time. Turn on Enforce SSO to switch off password sign-in for your organisation.

IP restrictions

Add ranges with a Starting IP and Ending IP. With at least one range, the platform only answers requests from those addresses, from people and bots alike. Check the page's warning before you save: a wrong range can lock everyone out, including you.

Sessions

Idle timeout: minutes without activity before someone is signed out (5 to 120, 60 by default; 15 is recommended for regulated work). People are warned 2 minutes before.
Session length: hours after signing in before someone must sign in again, however active they are (1 to 24, 24 by default). Bots are not affected.
Limit concurrent sessions: one active session per person. Signing in somewhere new signs out the others.

Email domains and joining

Under Settings › Access control › Email domains, list the domains people may sign up with. Once one of your admins has a confirmed address on a domain, anyone signing up with that domain joins your company. Workspace join decides whether they join at once or wait for an admin to Approve or Reject them.

Access review

Under Settings › Access control › Access review, click Start a review. It takes a snapshot of everyone who can reach the workspace and asks you to decide, for each person, to keep, change or remove their access. When you are done, click Sign off this review. The result is kept as evidence (who reviewed, when, and what they decided) and can be exported as a spreadsheet.

Member access

Member access shows everything one person can reach in the workspace and how they get in, including when they last signed in. Use Change role and teams to adjust it.

Sign-in activity

Settings › Audit › Sign-in activity shows every sign-in attempt across the workspace: successes, wrong passwords, lockouts and refusals, from browsers and from bots. Filter to Failed attempts only or Bots only to look for trouble.

Sign-in and account security