Team security

Open the team switcher at the top of the rail, choose Team settings, then Security. Only owners and admins can change these. They apply to members; clients and reviewers aren't affected.

Require two-factor sign-in

Turn on Require two-factor sign-in to make every member use a code from an authenticator app. Turn it on for your own account first, in Account › Profile. See Two-factor sign-in.

Members without it can only reach their account until they turn it on. While it's required, the page lists who you're still waiting on, and members in the team can't turn their own two-factor sign-in off.

Only invite emails at

Enter one or more domains, separated by commas, and choose Save. Invites to any other address are refused, and an invite already sent to another address can't be accepted. Leave it empty to allow any address.

Sign members out after

Choose 1 day, 7 days or 30 days, or Never. It's counted from when each member last used Plotter, and applies to everyone in the team on every device. They sign in again to carry on.

Single sign-on (SAML)

People at your team's email domains can sign in through your identity provider: Google Workspace, Okta or Microsoft Entra. The first time they sign in, they join the team as members. Owners can always sign in another way, so you can't lock yourself out.

Set it up in Team settings › Security › Single sign-on:

1. Add Plotter to your identity provider. In Google Workspace: Admin console › Apps › Web and mobile apps › Add app › Add custom SAML app. Copy Plotter's ACS URL and Entity ID into the "Service provider details" step. Set Name ID format to EMAIL and Name ID to Basic Information › Primary email. Then turn the app on for your users.
2. Copy the provider's details back. From Google's "Google Identity Provider details" step, paste the SSO URL, Entity ID and Certificate, and choose Save.
3. Verify your email domains. Add a domain such as yourcompany.com. Plotter shows a TXT record: add it at your DNS host, then choose Verify. Your provider can only sign in addresses at verified domains, and a domain can sign in through one team.
4. Turn on single sign-on. People then choose Sign in with SSO on the sign-in page and enter their work email.

Require it for members makes members sign in with SSO to use the team; owners aren't affected. Try it with a member account before you turn this on.

Opening Plotter from your provider's app menu takes you to Plotter's sign-in page: enter your work email under Sign in with SSO to finish.

Audit log

Owners and admins see who did what under Audit log: sign-ins and changes to members, security, review links, projects, integrations and billing. Filter by kind, and choose Export CSV for the last year.