The Security tab in Global Settings controls system-wide security in SmartSimple, including password and privacy policies, security matrices, record locking, session timeout, data management policies, and system security toggles. Each setting is defined below.
Business Security Settings
To access the Business Security settings, click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, click the Security tab, and locate the Business Security section.
| Setting | Description |
|---|---|
| Password and Activation Policies | Manages user activation email templates and password policies. The Password Policy controls the length and complexity of passwords, password expiration and history, the number of retries allowed, and the lockout time when a user exceeds the number of retries. CAPTCHA validation can also be enabled here. |
| Privacy and Security Policies |
Allows organizations to highlight their privacy and other stated policies, provides tools to manage country and language combinations, and places persistent links to policies on login pages and user portals. For more information, see Privacy and Security Policies Overview. |
| Organization Security Matrix |
Allows system administrators to restrict interaction with organizations and associated categories. The Organization Security Matrix defines how users can interact with company data, based on how they need to interact with the data. For more information, see Set Up Organization and User Security Matrix. |
| User Security Matrix |
Allows system administrators to restrict interaction with user records and associated entities. The User Security Matrix defines how users can interact with user data, based on how they need to interact with the data. For more information, see Set Up Organization and User Security Matrix. |
| System Feature Permissions |
Allows system administrators to personalize the SmartSimple instance and make system features available to users in different roles. Features include Batch Update, Email Broadcast, SmartFolder Access, Emulation Mode, Personal Dashboards, SmartCards, and others. For more information, see System Feature Permissions Settings Reference. |
| System Visibility Permissions | Allows system administrators to personalize the SmartSimple instance and make system objects available to users in different roles. |
| System Configuration Lock | Locks and unlocks system configuration settings. The lock removes access to all settings in the SmartSimple instance and uses a global system-lock password. |
| Virus Infected Files | Shows all virus infected files. |
| Anonymize Record Lock Owner for Organization and User Records | Hides the identity of the user who locked a User or Organization record from users in the selected roles. |
| Override Record Lock for Organization and User Records | Allows the selected roles to override the record lock. |
| Session Timeout | Controls how long a user can be inactive in the browser before the system logs the user out automatically. Enter the duration in minutes. |
| Security Matrix Updates - Users to Notify | Notifies the selected users if the security matrix is updated. |
Data Management Policies Settings
To access Data Management Policies settings, click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, click the Security tab, and locate the Data Management Policies section.
| Setting | Description |
|---|---|
| Data Policies | Configures Data Policy settings. Policy types include Retention policies and Security policies. Policies can be set to require acceptance at a regular interval. |
| Policy Field Sets | Configures Data Policy Field Sets. These field sets are linked to Data Policies to ensure that policies contain the correct information. |
System Security Settings
To access System Security settings, click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, click the Security tab, and locate the System Security section.
| Setting | Description |
|---|---|
| Enable Enhanced Security Mode | Presets and disables configurations on options related to system security. This also disables legacy applications. |
| Enable Maintenance Mode |
Restricts system access to designated roles while updates, data reviews, or security responses are in progress. For more information, see Use Maintenance Mode. |
| Enable URL Parameter Encryption | Encrypts object IDs such as custom field IDs, userid, companyid, and activity in internal system URLs. This enhances security by making it impossible to guess URLs. |
| Enable Profile Email Address Change Verification | Enables additional verification mechanisms when a profile’s email address changes. |
| Enable Logout | Configures the system to log out the user automatically and store the session end time in the user log when the user clicks the Logout button, navigates to a different website, or closes the browser. A confirmation message can also be enabled to confirm the logout. |
| Enable Classic Security Matrix Behavior | This setting is less secure and not recommended. The Classic Organization/User Security Matrix allows a Hierarchy Permission or a Category/Role to be set. If this setting is disabled, it is recommended to set both a Hierarchy and a Category/Role for improved security. |
| Enable Strict SQL Syntax Check For Desktop API | Restricts the SQL syntax accepted in criteria submitted through the desktop API to an allow list of approved syntax. |
| Disable ID Encryption for User/Organization Lookup Standard Fields | Disables identity encryption for both User and Organization Lookup Standard fields. |
| Disable External Login Shortcut | Disables the use of the external login shortcut (exlogin) from the URL. |
| Disable Template Page Security | Bypasses security validation when a user edits existing records on a UTA/module template page without an authenticated session. |
| Disable Calendar Activity Preview Template Security | Allows HTML code on the Calendar Activity Preview Template. |
| Disable Arcadia Portal Custom Script Restriction | Allows configuration of custom scripts in Arcadia portal settings. This is not recommended. |
| Disable Function and Syntax Validation on Logic and Formula Syntax | Bypasses security validation on the function and syntax used within logic conditions and formulas. |
| Disable Submitted Values Validation Against Pre-defined Options | Bypasses validation on the submitted values from fields with pre-defined options. |
| Disable Option to Serve Uploaded Files | When toggled on, links to uploaded files download instead of opening in the browser. |
| Disable Secure Document Generator | Disables the security option on the document generator to prevent the ability to pass contents to the generator directly without hash code validation. |
| Disable Session Timeout Login Prompt | Applies when Session Timeout is set. Disables the 30-second alert and login prompt pop-ups. When toggled on, the session expired login prompt is disabled so that the user can continue on the page the user was on and is redirected to the main login page. |
| Disable Secure Session Management |
Disables the validation for matching session IP and browser agent. This validation is one of the SmartSimple security features that protect against Cross Site Forgery attacks. If users are being randomly logged out, three options are available:
|
| IP addresses to bypass secure session validation |
Multiple IP addresses are separated by a comma.
Users with the specified IP addresses will bypass validation matching between the session IP and the browser agent which would otherwise log out users with an unstable IP address. |
| Disable Login Token Check | Allows user login without a session login token. This is not recommended for security reasons. |
| Block access to object lookup page | Blocks access to object lookup pages for unauthenticated sessions. |
| Suppress Local Administrator Alert | When toggled on, suppresses the email notification that is sent when new Local Administrators are created. When toggled off, emails are sent to all administrators when new administrators are created. |
| Global Allowed File Types | Defines the file types that can be uploaded in upload fields. Enter a comma-separated list of extensions for the file types to allow. Leave the field empty to allow all file types system-wide. Additional restrictions can be added on individual upload fields. |
| CAPTCHA Type |
Determines the CAPTCHA service. The recommended CAPTCHA service is Google's reCAPTCHA. The options include:
|
| Countries Using Alternate CAPTCHA Service | Countries added here use an alternate CAPTCHA service. This applies only when Global CAPTCHA Validation is set to Enabled or Inherit. |