Security

Administrators Only

This setting is only visible to users with the Administrator role.

The Security settings allow you to restrict access to your organization based on IP addresses. By configuring an IP allow list, only users connecting from approved IP addresses or ranges can use the application.

Opening Security Settings

1. Navigate to Admin Settings → Security
2. You will see the IP Allow List configuration panel

IP Allow List

The IP allow list lets you define which IP addresses or ranges are permitted to access your organization. When no restrictions are configured, all IP addresses are allowed.

How It Works

• Enter one or more CIDR ranges (IP address ranges in CIDR notation)
• Only users whose IP address falls within one of the specified ranges can access the application
• Users from other IP addresses will see a blocked access page

Which IP address is meant?

The IP allow list refers to the public IP address – the IP address the client appears to have on the internet (or network) from the server’s perspective. It does not refer to the local or private IP address of the end device.

In practice:

• If your staff work on the office network, it is the public IP address of your internet connection.
• If staff connect via VPN, it is the IP address of the VPN gateway.

A typical use case: you enter the public IP address of your agency network or VPN endpoint to ensure that access is only possible from within the agency network.

Configuring the Allow List

1. In the Allowed CIDR Ranges text field, enter your IP ranges
2. Enter one CIDR range per line
3. Click Save

Example CIDR ranges:

192.168.1.0/24
10.0.0.0/8
2001:db8::/32

CIDR Notation

CIDR notation describes IP address ranges. For example:

• 192.168.1.0/24 includes all addresses from 192.168.1.0 to 192.168.1.255
• 10.0.0.0/8 includes all addresses starting with 10.x.x.x
• A single IP like 203.0.113.42/32 can also be specified

Removing Restrictions

To allow access from all IP addresses again:

1. Click Remove All Restrictions
2. Confirm the action in the dialog
3. All IP restrictions will be removed

Lockout Prevention

The system will prevent you from saving changes that would lock yourself out. Make sure your current IP address is included in the allowed ranges before saving.

Propagation Time

Changes to the IP allow list may take up to 60 seconds to take effect across all services.

Use Cases

IP restrictions are useful for:

• Office-only access: Restrict access to your organization’s office network
• VPN enforcement: Ensure users connect through your corporate VPN
• Compliance requirements: Meet regulatory requirements for access control

Two-Factor Authentication (2FA)

In the Two-factor authentication section, you can require all users in your organization to log in with an additional security step.

How It Works

When two-factor authentication is required, all users must protect their account with an authenticator app (e.g. Google Authenticator, Microsoft Authenticator, or Authy). During login, a one-time code from the app is requested in addition to the password.

Requiring 2FA for Your Organization

1. Navigate to Admin Settings → Security
2. Enable the Require two-factor authentication toggle
3. The change applies at each user’s next login

Users who have not yet set up two-factor authentication will be prompted to do so at their next login before they can continue.

Disabling the 2FA Requirement

Disable the toggle to lift the requirement. Users who have already set up 2FA keep their configuration — it simply is no longer enforced.

Recommendation

Two-factor authentication significantly increases the security of your organization. We recommend enabling it, especially when users work from outside the agency network.

Next Steps

• Manage Users — Control who has access to your organization
• Teams — Organize users into groups with specific permissions