> ## Documentation Index
> Fetch the complete documentation index at: https://help.emaillove.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and sign-in

> Turn on two-factor sign-in, sign people out after a period of inactivity, set up single sign-on with SAML, and check the audit log.

Security settings are in **Settings**, under **Security**: **Sign-in security**, **Single sign-on** and **Audit log**. Admins and the account owner can open them.

## Two-factor sign-in

Two-factor sign-in asks for a code from an authenticator app when you sign in.

1. Go to **Settings** › **Sign-in security**.
2. Under **Your two-factor sign-in**, click **Set up two-factor sign-in**.
3. Scan the QR code with your authenticator app and enter the code it shows.
4. Click **Turn on**.
5. **Save these recovery codes** somewhere safe. Each one gets you in once if you lose your phone.

To get new recovery codes, click **New recovery codes**. To stop using it, click **Turn off**.

### Require it for everyone

The account owner can make two-factor sign-in compulsory.

1. Turn on two-factor sign-in for yourself first.
2. Under **Sign-in rules for** your organisation, turn on **Require two-factor sign-in for everyone**.

Anyone who hasn't set it up is asked to do so the next time they sign in. People who sign in with single sign-on aren't asked.

## Sign out after inactivity

The account owner can sign people out when they haven't used the Builder for a while.

1. Go to **Settings** › **Sign-in security**.
2. Under **Sign-in rules for** your organisation, choose **Sign out after this long without using Email Love**: **Never**, **30 minutes**, or 1, 2, 4, 8, 12 or 24 hours.

This applies in the browser. The Email Love Figma plugin stays signed in.

## Single sign-on

Single sign-on (SSO) lets your team sign in with your identity provider using SAML. It's part of the Enterprise plan. If your plan doesn't include it, the page says so, with a way to contact us.

The account owner sets it up in **Settings** › **Single sign-on**.

**1. Add Email Love to your identity provider**

Copy the **Single sign-on URL (ACS URL)** and the **Audience URI (SP entity ID)** into a new SAML app in your identity provider.

**2. Enter your identity provider's details**

* **Identity provider**: Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, or **Another SAML provider**.
* **Identity provider entity ID (issuer)**, **Sign-in URL** and **Signing certificate**, from your identity provider.
* Tick **Make an account the first time someone new signs in** to add people automatically, and choose whether **New people join as** Editors or Commenters.

Save. The page then shows a **Metadata URL** and a **Sign-in link for your team**.

**3. Link accounts**

Click **Link my account** to link your own Builder account to your identity provider. The page shows how many people have linked. Other admins link their accounts the same way.

**4. Require it, if you want**

Once your own account is linked, you can turn on **Require single sign-on for everyone**.

**5. Provisioning (SCIM), if you want**

To add and remove people from your identity provider, copy the **SCIM base URL**, click **Make a token**, and add both to your identity provider. The page has instructions for Okta and Microsoft Entra ID.

To stop using it, click **Turn off single sign-on**.

## Audit log

**Settings** › **Audit log** lists who did what in the account: sign-ins, invites, role changes, design system changes and more. It's kept for 12 months.

* Filter by **Last 7 days**, **Last 30 days**, **Last 90 days** or **Last 12 months**, by person, by activity, or search.
* Click **Download CSV** for up to 1,000 rows.

Only owners and admins can see it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.