Sessions and IP allowlist

Settings → Sessions and IP allowlist controls how long your members stay signed in and where they can sign in from. Only an organization admin can change it.

Session policy

Set how long a session may stay idle and how long it may last in total. Leave a field blank to use the system default.

IP allowlist

When it is on, members can use the app only from the network ranges you list (CIDR notation, for example your office's public range). Requests from anywhere else are refused, for the app, the API and AI assistant connections alike.

• Add your own current address before you turn it on, or you will lock yourself out.
• Platform staff accounts are not limited by it.

Multi-factor authentication

An admin can require a second factor of every member: an authenticator app or a passkey, set up under My security. If your identity provider enforces MFA, Settings → Single sign-on can let an SSO sign-in count as the second factor.