Help guides

Required MFA and idle sign-out

Two rules for the people who sign in to your SignSwifly workspace — you and your team. Both come with the Solo plan and up, and only the owner or an admin can change them. They don’t apply to the people you send documents to: signers open a signing link and never sign in.

Required MFA

When MFA (multi-factor authentication) is required, everyone who signs in to your workspace with a SignSwifly password or email code completes a second step — a one-time code sent to them — before SignSwifly lets them in. That includes the owner.

People who sign in through company sign-in (on Scale) are left to your identity provider: require MFA there. SignSwifly can’t see whether your provider asked for it.

Turn it on

  1. Sign in as the owner or an admin and open Settings → Security & SSO.
  2. Under Multi-factor authentication, choose Require MFA.
  3. SignSwifly asks you to verify first: enter the code you’re sent. This proves the second step works for your workspace before anyone is held to it.
  4. You come back to Settings, and MFA reads Required.

The change is recorded in Settings → Team → Activity, with who made it and when.

What your team sees

The next time each person uses SignSwifly they’re asked for a one-time code. After that their sign-in carries it, but they’re asked again when they sign in afresh or on another device, and may be after about a day. Before you turn it on, make sure everyone’s sign-in email is one they can actually receive codes at.

Turn it off

Choose Stop requiring MFA and confirm. Turning it off is allowed on any plan.

Idle sign-out

SignSwifly can sign people out after a stretch with no activity: 15 or 30 minutes, 1, 2, 4, 8 or 12 hours, or never, which is how every workspace starts.

Set it

  1. Open Settings → Security & SSO and find Idle sign-out.
  2. Choose how long, and select Save.

It applies from the next page each person opens.

What your team sees

  • Two minutes before, a box asks Are you still there? with Stay signed in, and warns that anything not saved may be lost. Clicking, tapping, typing or scrolling in SignSwifly counts as staying. Only moving the pointer doesn’t.
  • Activity in any SignSwifly tab in the same browser keeps them signed in in all of them.
  • A tab left open overnight signs out the moment it’s looked at again.
  • Once signed out, they sign in again to carry on.

If your plan changes

Both rules can be turned on, or made stricter, on Solo and up. If your workspace moves to Free, rules you’ve already set stay in force, and can still be relaxed: MFA turned off, or the idle sign-out made longer or switched off.

Questions

Can we require MFA for admins only?

No. It applies to everyone who signs in to the workspace with a SignSwifly password or code, so nobody is the easy way in.

Does it change how our signers sign?

No. Signers use their signing link as before. A sender can also ask for a one-time code by SMS to check a signer’s identity before they sign, on Scale, on Solo and Team with the SMS add-on, and on Free with a single envelope with SMS.

Someone can’t receive their code. What now?

The owner or an admin can stop requiring MFA while it’s sorted out, then turn it back on. Or email us.

Nobody who can change these rules can sign in. What now?

Company sign-in never stops the owner, or any break-glass admins the owner has named: they can sign in with their own SignSwifly sign-in (and their code, if MFA is required). Any of them can stop requiring MFA, or company sign-in, under Settings → Security & SSO.

If none of them can get in, the owner (or an admin, if the owner has left or can’t be reached) can email SignSwifly support and ask us to stop requiring them. Before we change anything, we email the owner, every admin and your organisation’s email address, and wait at least a working day. Anyone we email, and any owner or admin, can cancel it in that time. Nobody can make it sooner, including us.

If only one person in your workspace can change these rules, add a second admin now (Team and Scale have room for more than one person), so one lost mailbox can’t lock everyone out.