> ## Documentation Index
> Fetch the complete documentation index at: https://staging.docs.flowsign.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Organisation security

> Single sign-on, session limits, an IP allowlist and data retention for the whole organisation.

**Organisation security** holds the controls that apply to every member of your organisation, separate from the personal sign-in settings under [My account](/guides/account/my-account). Each section shows its current state as a chip in its header, and saves on its own.

<Frame caption="Organisation security, with single sign-on, verified domains, session timeout and the IP allowlist.">
  <img src="https://mintcdn.com/doc-a97e5290/CtLjU_PfJfA-w8X1/images/guides/settings/security.png?fit=max&auto=format&n=CtLjU_PfJfA-w8X1&q=85&s=a1c89c09bf3f25c7d7a206c94aad46d4" alt="The organisation security settings page showing single sign-on, verified domains, session timeout and the IP allowlist" width="2880" height="1800" data-path="images/guides/settings/security.png" />
</Frame>

## Session timeout

"Sign members out after a period of inactivity, and after a maximum session length." Set an **Inactivity timeout**, a **Maximum session length**, or both. Left on the default, a session lasts 7 days, or 12 hours when **Require SSO** is on.

## IP allowlist

"Only allow sign-in and API access from the networks you list." Add an IPv4 address, a CIDR range such as `203.0.113.0/24`, or an IPv6 address.

The list applies to every member and every API key as soon as it is saved, so FlowSign asks you to confirm that the first address you add is the network you are on right now. Removing an address cuts off anyone on it once you save. Removing every address turns IP restrictions off.

## Data retention

"Automatically delete old documents after a set time." Turn on **Automatically delete completed documents** and choose how many days after completion a document is kept. Once that window passes, the package and its stored documents are permanently deleted. Copies emailed to each party when the package completed stay in their inboxes; retention can't reach them. Turning it on asks for confirmation because it affects every completed document.

## Single sign-on

Single sign-on requires a plan with the `sso` gate. On a lower plan the page shows a locked upsell in its place, and the three sections below are hidden.

### Verified domains

"Prove you own your email domains so members on them can sign in with SSO." Add a domain such as `yourcompany.com` and verify it. A domain must be verified before SSO can be turned on. Removing a domain means members on it can no longer sign in with SSO.

### Single Sign-On (SAML)

"Allow members to sign in via your identity provider." **Enable SAML SSO** routes sign-ins for your verified domains through your identity provider using SAML 2.0.

**Require SSO** goes a step further: members on your verified domains must sign in through your identity provider. Organisation admins can still use their password.

### User provisioning (SCIM)

"Let your identity provider add, update and deactivate members automatically." Generate a SCIM token and paste it into your identity provider. The token is shown once, so copy it straight away.

Rotating the token stops the current one immediately, and provisioning pauses until the new token is in your identity provider. Revoking it stops provisioning altogether. Existing members are not affected, and you can generate a new token at any time.

## Related

* [Members](/guides/settings/members)
* [Roles and permissions](/guides/settings/roles-and-permissions)
* [API keys](/guides/settings/api-keys)
* [My account](/guides/account/my-account)