Security and sign in

Two step verification

Turn it on from Your account, Security. Scan the QR code with any standard authenticator app, enter the 6 digit code it shows, and save the backup codes. Each backup code signs you in once if you lose your device.

To turn it off or replace your backup codes, you confirm with your password and a current code. It cannot be turned off while an organization you belong to requires it.

Requiring it of everyone

Owners and admins can require two step verification of every member, on every plan, under Settings, Security. Turn it on for your own account first: requiring it is refused until you have it, so the change never shuts you out. The panel shows how many members do not have it yet.

Once it is required, a member without it loses the organization on their next request and is asked to turn it on; nothing else of the organization opens until they do, and it then opens in the same session, without signing in again. Owners are held to it too. A member your identity provider signs in through single sign on is exempt, as the identity provider enforces its own second factor. Each change is recorded in Audit logs.

CostReveal's own staff always use two step verification: the system console and every read only inspection of an organization refuse anyone without it.

Sessions

Your account, Security, Sessions lists every browser and device signed in to your account. Sign out any one of them, or all except the one you are using. Changing your password signs out every other session; resetting it signs out all of them.

Password resets

Choose Forgot password? on the sign in page. The emailed link is valid for 60 minutes and works once. The response is the same whether or not an account exists, so it cannot be used to discover who has one.

SAML single sign on

Single sign on is part of the Enterprise plan. It needs a verified company domain, which your organization gains when an owner with a work email confirms their address.

1. In your identity provider, create a SAML application. Take the Entity ID, the Assertion consumer service URL and the Single logout URL from Settings, Security, and download CostReveal's signing certificate. The entity ID is also a metadata URL, for identity providers that import one.
2. In CostReveal, enter your identity provider's entity ID, its single sign on URL, its single logout URL if it has one (both https only), and its signing certificate in PEM format.
3. Turn on Enabled and save.

People with an address on your domain then enter their email on the sign in page and choose Continue with single sign on; anyone who still needs a password can choose Use a password instead. Someone signing in for the first time gets an account automatically. The certificate is stored encrypted and never shown again; paste it each time you save the settings.

CostReveal signs every request it sends your identity provider, and accepts only signed assertions and signed logout requests from it.

Requiring single sign on

Turn on Require single sign on to make everyone with an address on your domain sign in through your identity provider. A password session already open loses the organization on its next request, and the person is offered the identity provider instead. Owners can still sign in with a password, so a problem with the identity provider never locks the organization out. Guests with addresses on other domains are not affected, because your identity provider cannot sign them in.

Single logout

With a single logout URL saved, signing out of CostReveal also signs the person out of your identity provider. When your identity provider confirms it, with a signed answer, the sign in page says the person is signed out of both; if it does not, the page says so, and suggests signing out there too. Your identity provider can sign people out of CostReveal too: it ends the session it names, or every session of that person when it names none. A logout request is accepted once, and only within ten minutes of being issued, so a captured one cannot be replayed.