Security: sign-in log, password rules and two-factor sign-in
See every sign-in try, set password rules, ask for a second factor or a passkey, and limit sign-ins by network, device and hours. Settings can differ per Entity, and every part comes with every plan.
PLANSEvery plan
The problem it solves
- Nobody can tell who signed in last night, or from where.
- Staff use short, easy passwords that anyone could guess.
- A former employee's login still works on a phone nobody remembers.
- Office records can be opened from any network at any hour.
How it works
- The administrator opens the Security app. Sign-ins are logged from day one; every other setting stays off until you switch it on.
- Under Security Settings, set password rules, the lock after wrong tries, session limits, two-factor sign-in and approved devices.
- Add IP rules to allow only the office network or to block addresses. Add sign-in hours per weekday, with holidays.
- To give one Entity its own rules, add it under Settings per Entity. Someone who works in several Entities meets the strictest of them.
- Follow it under Security > Activity: the sign-in log, open sessions, devices waiting for approval, and each login's password age and strength.
Everything it does
Sign-in log
- Every try on the web and in the apps, signed in or refused, with the reason
- How the person signed in: password, passkey, single sign-on or one-time code
- IP address, country and city when known, browser, system and device
- Kept 365 days to start with; passwords are never recorded, not even wrong ones
- A message to the person after a sign-in from a new device, when you switch it on
Passwords and locks
- Minimum length and strength, and the kinds of characters a new password needs
- No reuse of recent passwords, and expiry with a new password asked at sign-in
- Lock after wrong tries for a set number of minutes; an administrator can lift it earlier
- Ask for a New Password: the person chooses one at their next sign-in
- Portal users, such as parents, residents or customers, can be covered too
Two-factor sign-in and devices
- Two-factor sign-in for everyone or for chosen roles, with days to set it up
- A code from an authenticator app, or a passkey: fingerprint, face or security key
- A trusted device skips the code for 30 days to start with
- Approved devices only: a new device waits until a Security Administrator approves it
- Revoke a device and it is signed out at once
Networks, sessions and hours
- IP rules: allow only these addresses or block these, for everyone or chosen roles
- Sessions per login, idle time-out and longest session
- Sign one session out, or sign a person out everywhere
- Sign-in hours per weekday, closed on holidays, read in the Entity's time zone
- A rule that would lock out the person saving it is refused
Who uses it
AdministratorSwitches the rules on and reads the log.
Security AuditorReads the sign-in log, sessions, logins, settings and IP rules.
Security AdministratorChanges settings and IP rules, lifts locks, approves devices and signs sessions out.
Staff memberSets up the second factor where it is asked for, and signs their own other devices out.
Where you use it
- Web: the Security app in the back office
- The SmartMy phone apps: the same checks, with the code, new password and two-factor set-up screens
- The sign-in page: the reason when a sign-in is refused
What you control
Settings
- Security Settings: sign-in log, passwords, IP rules, sessions, two-factor, devices and sign-in hours
- Settings per Entity: one Entity with its own settings, copied from the default
- IP rules and sign-in hours for everyone, chosen roles or one Entity
- Sessions Allowed per user, on the user's Account Security tab
Approvals
- Device approval: a Security Administrator approves or refuses a device that waits
Notifications
- Login locked: to the person and the Security Administrators
- Device waiting for approval: to the Security Administrators, at once
- New sign-in to your account: to the person, when you switch it on
Questions
Is security an add-on?
No. Every security feature is in every plan of SmartMy Lease.Can an administrator see passwords?
No. Only the length and strength of a password when it was set, and its age.Can one branch have stricter rules?
Yes. Give that Entity its own settings. People who work in several Entities meet the strictest of them.Do the phone apps follow the same rules?
Yes. The apps ask for the code, a new password or the two-factor set-up, as the web does.Related features
ACROSS SMARTMY LEASEApproval chainsWork orders, tenant applications, fit-out drawings and charges wait for levels of approval, such as the owner of the unit for repairs over their limit. Each kind has a chain per Entity, with the managers as the first level.ACROSS SMARTMY LEASENotificationsTenants, guests, members, owners and vendors hear about bills, payments, cheques, checks, notices, repairs and lease dates, and your team hears what needs them. Email and the in-app inbox work with no set-up; a few rental events can also go by WhatsApp or SMS.ACROSS SMARTMY LEASEStaff chatProperty managers, agents, the front desk and accounts chat inside SmartMy, one to one or in groups, with photos and files. Nobody needs a colleague's personal number to ask about a key.
See your buildings on it.
Tell us how many properties and units you have, whether you let your own or manage for owners, and how rent is paid today. We will set up your portfolio with you on SmartMy Lease.