Help centre

Security

How you sign in, how to make it safer, and how a workspace keeps a record of who did what.

Signing in with a link

There is no password to steal, reuse or forget. Each sign-in link works once, for 20 minutes, and you can ask for 5 links in 15 minutes. A link that didn't work says so, and sends a new one to the same address in one tap.

A second step

Turn on a second step in Your account, so your email alone can't open your account. It is yours, in every workspace.

• Authenticator app: choose Set up beside it and scan the QR code with an app such as 1Password, Google Authenticator or Authy. Can't scan? Type the setup key instead (Copy the setup key helps), or open the link on the device that has the app. Then type the 6-digit code it shows. Turning it on signs you out on your other devices. The QR code is drawn on your screen; the key isn't sent anywhere to make it.
• Recovery codes: shown once, when you turn on the second step. Copy all or Download them, keep them somewhere safe, and choose I've saved them. If you lose your phone, each code signs you in once; choose Use a recovery code at sign-in.

There are no text-message codes: an authenticator is safer, because a phone number can be moved to another SIM. Turning the authenticator off, changing your email, and deleting your account ask for a current code: from your authenticator, or a recovery code.

Your name and email

Your name and sign-in email are yours, in every workspace you are in. Change them in Your account:

• Change name: everyone in your workspaces sees the new name at once.
• Change email: type the new address and choose Send link. Nothing changes until you open the link we send there, so an account can't be moved to an address its owner doesn't read. The link works for 24 hours, and only the newest one counts. When you open it, you sign in with the new address from then on, links to the old one stop working, and the old address gets an email saying so. With the second step on, asking takes a current code too.

An address someone else already signs in with can't be taken. In a workspace that signs in with single sign-on, the identity provider sets your email; ask its owner to change it there.

Your devices

You stay signed in for 14 days, or until you haven't used Release Social for 3 days. Sign out other devices in Your account ends every session but this one, for example after losing a laptop.

So that screens open at once, Release Social keeps what it has shown you on this device for up to a day, for you in that workspace only, and asks the server only what changed. Sign out removes it; on a shared computer, sign out when you're done.

If you're removed from a workspace, your access to it ends at once.

Single sign-on

An owner or admin can make the workspace sign in through the company's identity provider, in Settings → Security → Single sign-on: Off, OIDC (the issuer, client ID and client secret) or SAML (the sign-in address and the certificate). Secrets are stored encrypted; type a new one to replace it.

Then people choose Continue with single sign-on on the sign-in page. Require single sign-on turns off email links for everyone, and asks first: make sure it works for you before you turn it on, because if it breaks, nobody can sign in with a link. Requiring it signs out the workspace's other sessions.

Single sign-on comes with Agency and Enterprise. On a smaller plan, what was set up keeps working, so nobody is locked out, but it can't be changed.

The audit log

The audit log records who changed what, and when: sign-ins, two-factor changes, roles, channels, approvals, posts and settings. Settings → Security shows the latest events; Audit log shows them all as sentences, filtered by Everyone, Security or Posts. Owners and admins can read it.

The audit log comes with Team and up. It is recorded on every plan, and shown once the plan has it.

An owner can choose how long it is kept, in Settings → Data.

Keeping your workspace safe

• Give each person the smallest role that lets them do their work. See Team.
• Use named approvers, so nothing goes out without the right yes. See Approvals.
• Turn on the second step, and ask your team to do the same.
• Create API keys only for the tools that need them, name them so you know which tool uses each, and Revoke a key the moment a tool stops using it. A key can create drafts and read them, never approve or post.