Sign-in and security

Signing in

Staff sign in with their email address and password. Clients and associates have their own portal sign-in pages and never use the staff sign-in.

After ten failed attempts within 15 minutes, the account is locked for 30 minutes and the person sees how long to wait. This stops anyone guessing passwords.

Emailed codes for unexpected places

When Login security is switched on, IPBases checks where each sign-in comes from:

• From a country on your allowed list, or from your office network, the person signs in as normal.
• From anywhere else, IPBases emails a six-digit code that must be entered before the sign-in completes.

A code works for 10 minutes and allows five tries. The person can ask for a new code after 60 seconds, up to three times. You choose whether sign-ins from countries that cannot be identified need a code too.

Trusted devices

When entering a code, the person can tick trust this device. That browser is then not asked again for the number of days you set (30 by default, up to a year). An administrator can see trusted devices and revoke them from Login security.

Forgotten passwords

Forgot password on the sign-in page emails a six-digit code that works for 15 minutes; the person then chooses a new password of at least eight characters. The page always gives the same answer, whether or not the email is registered, so nobody can use it to find out who has an account.

Anyone signed in can change their own password from their profile.

Temporary access links

An administrator can create a link that signs someone in without a password, for example for a short support session. Each link can expire, be limited to a number of uses and be revoked at any time. Every use is recorded in the audit log, and a banner shows that the session came from a temporary link.

How it connects

This part of IPBases takes information from the parts on the left and changes what appears in the parts on the right. When you change one of them, check the other.