Security policies

Settings > Security holds the rules that apply to everybody in your organisation, rather than to one person or one brand. You need the Tenant Admin role to open it.

Require two-factor authentication

Turn on Require all members to use two-factor authentication and everyone has to set up an authenticator app. On the web, anyone without it is asked to set it up at their next sign-in. On mobile, they can’t sign in at all until they’ve done it on the web.

Click Save to apply it.

Caution

There’s no grace period. It bites at each person’s next sign-in, so check your team can reach an authenticator app before you switch it on.

People set two-factor up themselves under Profile and security.

Mobile device policies

Four switches govern what the mobile app may do on your field workers’ phones. They share one Save, and they apply to your whole organisation.

Allow keeping the screen awake during active jobs

Off to start with. Turn it on and a field worker can choose, on their own device, to stop the phone locking itself while they work a job. It’s useful when someone is following a form with wet or gloved hands.

Caution

This suppresses the phone’s auto-lock. An unattended phone stays unlocked, showing whatever job was open. Leave it off unless devices stay with the person or are physically secure.

Require location sharing while working

Turn this on and field workers have to share their location while they’re working, with no way to switch it off on their device. “Working” means their working hours, plus any time they’re en route or on site at a job outside them. The app tells them their organisation requires it rather than quietly hiding the control.

Location is personal data about your staff. Tell your field workers before you turn it on and cover it in their privacy notice. How long it’s kept is set under Privacy and data.

Allow screenshots on mobile

On to start with, which is what most teams want: it’s how an engineer sends a job screen to the office or to a colleague.

Turn it off if you’d rather customer and job details didn’t leave the app that way. Capture is then blocked on every signed-in screen, for everyone.

Allow reporting from mobile

On to start with. It controls whether field workers can raise observations from the app. Turn it off and the report button disappears for your whole organisation.

Which roles may report is a separate question, answered by their role. See Roles and permissions.

Recent security activity

The bottom of the page lists what has happened at the door of your workspace, newest first: who signed in and from what address, sign-ins that failed, accounts locked out, passwords changed, sessions ended, two-factor being turned on or off, and email codes being sent and used.

It’s the place to look when someone reports they’ve been locked out, or when you want to check an account is being used from where you’d expect.

What’s next

• Privacy and data: how long data is kept, and subject requests
• Authentication and single sign-on: how people sign in
• Availability and settings: how these land on a field worker’s phone