Skip to main content
Organisation security holds the controls that apply to every member of your organisation, separate from the personal sign-in settings under My account. Each section shows its current state as a chip in its header, and saves on its own.
The organisation security settings page showing single sign-on, verified domains, session timeout and the IP allowlist

Organisation security, with single sign-on, verified domains, session timeout and the IP allowlist.

​
Session timeout

“Sign members out after a period of inactivity, and after a maximum session length.” Set an Inactivity timeout, a Maximum session length, or both. Left on the default, a session lasts 7 days, or 12 hours when Require SSO is on.

​
IP allowlist

“Only allow sign-in and API access from the networks you list.” Add an IPv4 address, a CIDR range such as 203.0.113.0/24, or an IPv6 address. The list applies to every member and every API key as soon as it is saved, so FlowSign asks you to confirm that the first address you add is the network you are on right now. Removing an address cuts off anyone on it once you save. Removing every address turns IP restrictions off.

​
Data retention

“Automatically delete old documents after a set time.” Turn on Automatically delete completed documents and choose how many days after completion a document is kept. Once that window passes, the package and its stored documents are permanently deleted. Copies emailed to each party when the package completed stay in their inboxes; retention can’t reach them. Turning it on asks for confirmation because it affects every completed document.

​
Single sign-on

Single sign-on requires a plan with the sso gate. On a lower plan the page shows a locked upsell in its place, and the three sections below are hidden.

​
Verified domains

“Prove you own your email domains so members on them can sign in with SSO.” Add a domain such as yourcompany.com and verify it. A domain must be verified before SSO can be turned on. Removing a domain means members on it can no longer sign in with SSO.

​
Single Sign-On (SAML)

“Allow members to sign in via your identity provider.” Enable SAML SSO routes sign-ins for your verified domains through your identity provider using SAML 2.0. Require SSO goes a step further: members on your verified domains must sign in through your identity provider. Organisation admins can still use their password.

​
User provisioning (SCIM)

“Let your identity provider add, update and deactivate members automatically.” Generate a SCIM token and paste it into your identity provider. The token is shown once, so copy it straight away. Rotating the token stops the current one immediately, and provisioning pauses until the new token is in your identity provider. Revoking it stops provisioning altogether. Existing members are not affected, and you can generate a new token at any time.