Security Settings
Company SettingsWhere to Configure
Security settings are managed under Account > Security or PII Redaction in the sidebar. Only the company owner can modify most security settings.
PII Access Control
When PII restriction is enabled, sensitive fields (phone numbers) are masked for all users except those explicitly granted access. Access is managed by selecting specific user emails that are allowed to view caller numbers.
See the dedicated article on PII Redaction for the full auto-redaction system that permanently removes aged data.
API Security
- Restrict API Access by IP Address?: when enabled, API requests using access tokens must come from one of the whitelisted IP addresses.
- Whitelisted IP Addresses: the list of allowed IP addresses; multiple IPs can be pasted at once, one per line.
- Require Authorization for Lead Creation?: when enabled, API requests that create leads must include a valid authorization token.
Only the company owner can change these settings.
Two-Factor Authentication
2FA is a per-user setting, not a company-wide toggle. It is auto-enforced in specific situations: when a user creates their first Offer, or when a team grants sensitive permissions (buying DIDs or updating buyers). There is no company-wide 2FA enforcement switch.
Session Timeout
There is no per-company session timeout setting. Sessions are managed at the application level via encrypted cookies.
