The Security tab in Global Settings controls system-wide security in SmartSimple, including password and privacy policies, security matrices, record locking, session timeout, data management policies, and system security toggles. The tab is organized into three sections: Business Security, Data Management Policies, and System Security.
To access these settings, click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Security tab.
Who: Global administrators
When to Use Security Tab Settings
Use the Security tab settings when:
- Access to organization and user records needs to be restricted through security matrices.
- Passwords need defined length, complexity, expiration, and lockout rules.
- Users need to accept retention or security policies at a regular interval.
- System access needs to be limited to designated roles during updates or security responses.
- Users are logged out unexpectedly and session settings need review.
Business Security Settings
The Business Security section controls password and privacy policies, access to organization and user records, access to system features, record locking, and session timeout.
Password, Activation, and Privacy Policies
Password and Activation Policies manage user activation email templates and password policies. The Password Policy controls password length and complexity, password expiration and history, the number of retries allowed, and the lockout time when a user exceeds the number of retries. CAPTCHA validation can also be enabled here.
Privacy and Security Policies allow organizations to highlight their privacy and other stated policies. This setting also provides tools to manage country and language combinations and places persistent links to policies on login pages and user portals. Additional guidance is available in Privacy and Security Policies Overview.
Security Matrices and Permissions
The Organization Security Matrix and User Security Matrix allow system administrators to restrict interaction with records. The Organization Security Matrix restricts interaction with organizations and associated categories. The User Security Matrix restricts interaction with user records and associated entities. Each matrix defines how users can interact with data, based on how they need to interact with that data. Set Up Organization and User Security Matrix provides specific information.
System Feature Permissions and System Visibility Permissions allow system administrators to personalize the SmartSimple instance. System Feature Permissions make system features available to users in different roles. Features include Batch Update, Email Broadcast, SmartFolder Access, Emulation Mode, Personal Dashboards, SmartCards, and others. System Visibility Permissions make system objects available to users in different roles. For field-level detail, see System Feature Permissions Settings Reference.
System Lock and Record Locking
System Configuration Lock locks and unlocks system configuration settings. The lock removes access to all settings in the SmartSimple instance and uses a global system-lock password.
Two settings control record locks on organization and user records. Anonymize Record Lock Owner for Organization and User Records hides the identity of the user who locked a record from users in the selected roles. Override Record Lock for Organization and User Records allows the selected roles to override the lock.
Session Timeout and Security Monitoring
Session Timeout controls how long a user can be inactive in the browser before the system logs the user out automatically. The duration is entered in minutes.
Two settings support monitoring. Security Matrix Updates - Users to Notify sends a notification to the selected users when the security matrix is updated. Virus Infected Files shows all virus infected files.
Data Management Policies Settings
The Data Management Policies section controls how data policies are configured and what information they contain.
Data Policies configure Data Policy settings. Policy types include Retention policies and Security policies. Policies can be set to require acceptance at a regular interval.
Policy Field Sets configure the field sets linked to Data Policies. These field sets ensure that policies contain the correct information.
System Security Settings
The System Security section contains toggles that enable security features or bypass specific security validations. The settings are grouped below by purpose.
Security Modes and Encryption
Enable Enhanced Security Mode presets and disables configurations on options related to system security. This mode also disables legacy applications.
Enable Maintenance Mode restricts system access to designated roles while updates, data reviews, or security responses are in progress. Use Maintenance Mode provides specific information.
Enable URL Parameter Encryption encrypts object IDs such as custom field IDs, userid, companyid, and activity in internal system URLs. This enhances security by making it impossible to guess URLs. Disable ID Encryption for User/Organization Lookup Standard Fields disables identity encryption for both User and Organization Lookup Standard fields.
Three additional settings strengthen verification and restrict syntax:
- Enable Profile Email Address Change Verification adds verification mechanisms when a profile’s email address changes.
- Enable Strict SQL Syntax Check For Desktop API restricts the SQL syntax accepted in criteria submitted through the desktop API to an allow list of approved syntax.
- Enable Classic Security Matrix Behavior is less secure and not recommended. The classic matrix allows either a Hierarchy Permission or a Category/Role to be set. If this setting is disabled, it is recommended to set both a Hierarchy and a Category/Role for improved security.
Login, Logout, and Session Settings
Enable Logout configures the system to log out the user automatically and store the session end time in the user log. This occurs when the user clicks the Logout button, navigates to a different website, or closes the browser. A confirmation message can also be enabled to confirm the logout.
Disable Secure Session Management disables the validation for matching session IP and browser agent. This validation is one of the SmartSimple security features that protect against Cross Site Forgery attacks. If users are being randomly logged out, three options are available:
- Set the network proxy to sticky sessions when communicating with SmartSimple.
- Bypass the network proxy and connect directly from the desktop or laptop computer to SmartSimple.
- Disable the Secure Session Management setting and accept the potential risk.
IP addresses to bypass secure session validation lets users with the specified IP addresses bypass the matching between session IP and browser agent. This setting helps users with an unstable IP address who would otherwise be logged out. Multiple IP addresses are separated by a comma.
- To enter a range of IP addresses, use a dash. For example,
65.93.203.0-65.93.203.255. - To enter IP addresses that follow a certain pattern, use an asterisk. For example,
126.12.*.*.
Several other settings adjust login behavior:
- Disable Session Timeout Login Prompt applies when Session Timeout is set. It disables the 30-second alert and login prompt pop-ups. When toggled on, the user continues on the current page and is redirected to the main login page.
- Disable External Login Shortcut disables the use of the external login shortcut (exlogin) from the URL.
- Disable Login Token Check allows user login without a session login token. This is not recommended for security reasons.
- Block access to object lookup page blocks access to object lookup pages for unauthenticated sessions.
- Suppress Local Administrator Alert, when toggled on, suppresses the email notification sent when new Local Administrators are created. When toggled off, emails are sent to all administrators when new administrators are created.
File Upload and CAPTCHA Settings
Global Allowed File Types defines the file types that can be uploaded in upload fields. A comma-separated list of extensions sets the allowed file types, and an empty field allows all file types system-wide. Additional restrictions can be added on individual upload fields.
Two settings change how files are handled. Disable Option to Serve Uploaded Files, when toggled on, makes links to uploaded files download instead of opening in the browser. Disable Secure Document Generator disables the security option on the document generator that prevents contents from being passed to the generator directly without hash code validation.
CAPTCHA Type determines the CAPTCHA service. The recommended service is Google’s reCAPTCHA. The options include:
- Google reCAPTCHA v3: Requires no user interaction and scores users automatically.
- Google reCAPTCHA v2: Improves bot identification by requiring users to check a box.
- Alternate CAPTCHA: Consider this option if community members are unable to access Google services.
Countries Using Alternate CAPTCHA Service lists the countries that use an alternate CAPTCHA service. This applies only when Global CAPTCHA Validation is set to Enabled or Inherit.
Validation Bypass Settings
Several settings bypass a specific security validation:
- Disable Template Page Security bypasses security validation when a user edits existing records on a UTA/module template page without an authenticated session.
- Disable Calendar Activity Preview Template Security allows HTML code on the Calendar Activity Preview Template.
- Disable Arcadia Portal Custom Script Restriction allows configuration of custom scripts in Arcadia portal settings. This is not recommended.
- Disable Function and Syntax Validation on Logic and Formula Syntax bypasses security validation on the function and syntax used within logic conditions and formulas.
- Disable Submitted Values Validation Against Pre-defined Options bypasses validation on the submitted values from fields with pre-defined options.
Resources
For more information about Security tab settings, see: