Security and identity
Sign in securely. Act within your role.
Set sign-in policy for each company. Access is denied by default unless an access rule allows it.
Show company sign-in settings with single sign-on and authenticator policy, alongside the Android second-factor screen.
Use the identity your team already has
Single sign-on per company
Connect OpenID Connect, Microsoft Entra ID or SAML 2.0 for each company.
A second check at sign-in
Set authenticator-app two-factor sign-in by company policy, with lockout after repeated failures.
Secure sign-in on Android
Single sign-on opens in the phone’s secure system browser. Authenticator setup and codes work on the phone itself. A new phone is registered only after the second factor; afterwards, PIN and biometric sign-in remain available.
Protected platform operations
Apply a stronger sign-in requirement to the people running the service. Every platform operator must use an authenticator app. Recovery codes cover a lost phone; operator sign-in does not use SMS or email codes.
A trusted browser lets an operator use a PIN. Sensitive actions require a fresh PIN or authenticator code, including acting inside a company, changing stores or managing keys.
Company phone sign-in continues to support authenticator codes and single sign-on through the phone's secure browser. Platform operators use their separate console and address. Explore Platform operations for operator roles and audited company sessions.
Protect connections in both directions
Authenticate API clients
Use client secrets, mutual TLS, signed JWT or SAML bearer authentication for secure API clients.
Connect to partner systems safely
Secure outbound authentication protects calls to partner systems. Calls are blocked from reaching internal network addresses.
Permissions, not guesswork
Give access through roles, with clear choices about responsibilities and records. A read-only catalogue describes 32 platform-defined company permissions in plain language, grouped by area. Selecting a higher permission automatically ticks the permissions it includes. You can only grant permissions you hold.
Separation-of-duty warnings flag risky combinations, such as design and approve. DynamicForm records every change to role permissions. Set record scope to Own, Team, Branch or All. Own covers records the user created. Team covers their own records and those of everyone below them in the reporting line. Branch covers records of the user's own branches. All covers every record of the company.
Review Permissions, Application access and Data scope together when deciding what a role needs. Explore Users and Roles for the catalogue, starter roles and application tabs.
Explore DynamicForm
AI Core · Multi-company SaaS · Security and identity · Branding and app publishing · Company Admin · Applications
Updated 30 October 2026