Security
What it does
Section titled “What it does”Security shows how the operator console is protected and lets you tighten it. You can require two-step sign-in for every operator, choose how long the console stays signed in without activity, and allow sign-in only from your office addresses.
The top shows Operators with two-step, Failed sign-ins, 24 hours, Sensitive reads, 7 days, Signed out after and Your address. Below, it lists every person with their two-step and state, and every sign-in attempt from the last 30 days with the device and address (Failed only narrows it).
Who can use it
Section titled “Who can use it”Upstay operators who can see the People area.
Where to find it
Section titled “Where to find it”People in the rail, then Security.
How to sign in
Section titled “How to sign in”- Open the admin. console. The page says Operator sign in.
- Enter Email or mobile and Password, then click Sign in.
- If you use two-step sign-in, type the six-digit Code from your authenticator app and click Continue. The code changes every 30 seconds.
- Lost your phone? Click Lost your phone? Use a recovery code and type one of your recovery codes. Each works once.
How to require two-step for everyone
Section titled “How to require two-step for everyone”- Turn on your own two-step first.
- Open Security.
- Switch on Require two-step sign-in.
- Click Save settings and confirm it is you.
An operator without two-step then sees a setup page the next time they open the console, and cannot open anything else until they finish it.
How to allow only some addresses
Section titled “How to allow only some addresses”- Open Security.
- Type one address or block per line under Only allow these addresses (optional), for example 203.0.113.7 or 198.51.100.0/24.
- Click Add my address if your own address is not in the list.
- Click Save settings and confirm it is you.
How to sign someone out everywhere or unlock them
Section titled “How to sign someone out everywhere or unlock them”- Open Security.
- Click Sign out everywhere on the person, or Unlock if they are locked out.
- Confirm it is you if asked.
Tips & good to know
Section titled “Tips & good to know”- Showing bank details, a document, a transcript or the payout file, downloading Activity or payments, and changing an operator or these settings, asks you to Confirm it is you with your password (and your code if two-step is on). It stays confirmed for 10 minutes.
- The console signs you out after the time you choose without any clicks or typing, and after 12 hours in any case.
- Signing in from a new device or address emails you, so you know if it was not you.
- Passwords for operators must be 12 characters or more and not a common one.
- The save is refused if it would lock you out: your own address must be in the list, and you need two-step before you can require it.
Troubleshooting
Section titled “Troubleshooting”- “Your own address (…) is not in the list. Add it, or you would be locked out.” → Click Add my address, then save.
- “This address cannot use the operator console” → You are signing in from an address not in the list. Ask another operator to add it.
- Signed out while reading → Reading without clicking does not count as activity. Choose a longer time under Sign out after this long without activity.
- Someone is locked out → Click Unlock on them.