Who gets in is your call
Owners can require two-factor and single sign-on. Idle sessions sign out after 15 minutes.
A password and a code, a passkey, or your company's own login.
Two-factor is four steps, and backup codes come with it
Confirm your password, scan the QR code with any authenticator app that makes time-based codes, enter the six-digit code, and save your backup codes. After that, each password sign-in also needs a code from the app, so a stolen password alone can't complete a password sign-in. Each backup code works once.
In Organization settings, an owner can require two-factor for every member, with a grace period of 3, 7, 14 or 30 days. A passkey satisfies the requirement too. If you haven't set up two-factor yourself, the page warns you before you save.
Owners can require single sign-on
Connect your identity provider, the system behind your company login, over SAML or OIDC. Once the domain is verified, an owner turns on enforcement and members can no longer sign in with a password. New people who arrive through single sign-on are added with the member role. Owners keep a password sign-in as a fallback, so an outage at your provider doesn't lock them out.
Set up under Organization, then SSO. Enforcement stays off until the domain is verified.
Idle sessions sign out, with a warning first
After 15 minutes with no activity, anyone signed in is signed out. Two minutes before that, a dialog counts down and offers Stay Logged In. A shared screen on a set or in a lab doesn't stay open.
Two-factor
Set up two-factor in your account settings. Confirm your password, scan the QR code with any authenticator app that makes time-based codes, enter the code to confirm, and save your backup codes. Each backup code works once.
After that, each password sign-in needs your password and a code from the app. A stolen password alone can't sign in.
In Organization settings, an owner can require two-factor for every member, with a grace period of 3, 7, 14 or 30 days. A passkey satisfies the requirement too. If the owner hasn't set up two-factor themselves, the page warns them before they save.
Passkeys
A passkey lets people sign in with their device instead of a password. Members add a passkey in account settings and give it a name.
Single sign-on
Connect your identity provider, the system behind your company login, over SAML or OIDC. People sign in through it, and new members are added with the member role.
Under Organization, then SSO, an owner can require single sign-on once the domain is verified. Members can then no longer sign in with a password. Owners keep a password sign-in as a fallback, so an outage at your provider doesn't lock them out.
Idle sign-out
Signed-in people are signed out after 15 minutes idle, with a warning two minutes before.
Talent
Talent don't have accounts. They open an approval link with an access code and a passcode sent in a separate email. See talent approvals.
Security documentation on request.
Questions
- What if I lose my phone?
- Two-factor setup gives you backup codes. Each works once. Keep them in a password manager.
- Can we require single sign-on?
- Yes. It works with SAML and OIDC identity providers. Once your domain is verified, an owner can require it, and members can no longer sign in with a password. Owners keep a password sign-in as a fallback for provider outages.
- What are passkeys?
- A passkey lets you sign in with your device instead of a password. Add one in your account settings and give it a name. It also satisfies an organization's two-factor requirement.
- What happens after failed sign-ins?
- After five failed attempts an account locks for 15 minutes, and the lock clears on its own. You'll see the usual invalid email or password message, and a password reset clears the lock.
- Where is the security documentation?
- Security documentation is available on request.
Tell us what you're shooting next.
Start with one title. Upload a shoot, bring its metadata in from a CSV, and confirm the cast. Then decide.
A person on our team reads it and writes back.