Skip to content

Settings — Your team, its permissions and its security, managed in one place.

Invite a colleague with their role, require two-factor authentication, find out who did what. Every app's settings sit in the same menu, open to administrators only.

Trusted by

  • Tunisair
  • Orange
  • Ford
  • Délice Danone
  • Vistaprint
  • FedEx
  • Peugeot
  • Zara
  • Celio
  • Condor
  • Royal Air Maroc
  • Pathé

Essentials

Who gets in, what they see, how they sign in.

Three settings to put in place on day one, before you open the sphere to the whole team.

A colleague joins, their invitation goes out.

By email, SMS, link or QR code, with their role already chosen. If nobody answers, the invitation expires after 7 days.

Three levels of permissions, easy to explain.

The owner keeps billing and security. Administrators manage members. Everyone else gets a functional role.

Two-factor authentication, for everyone.

An authenticator app, a security key or backup codes. Latecomers get a grace period.

Your team

Everyone in their place, with the access their job needs.

Organise your departments, write the roles of your business, open access to a partner. Then check, from time to time, that nobody kept more than they need.

Colleagues sit in units, the org chart follows, and each unit has its supervisor. A group can also fill itself, based on rules.

Security

Your sphere's security fits on one page.

The overview gives the status of each measure and says what needs work: accounts without two-factor authentication, a password that is too short, a session that stays open too long. One click opens the setting.

  • Two-factor authentication

    Required for all, with the methods you allow and a grace period.

  • Passwords

    Length, required characters, history, expiry, and a check against leaked passwords.

  • Sessions

    Sign-out after inactivity, account locked after repeated failures, unlocked by an administrator.

  • Sign-in

    OIDC providers, or sign-in with Google, Microsoft and LinkedIn.

Logs

Who did what, and when:
the log keeps it for 12 months.

Every action in the sphere, by a colleague, the system, a workflow or the API, goes into the log. You filter by author, action, app or period, then export to CSV. For an audit, reports and the evidence pack are generated from the same section.

  • Every action, kept for 12 months
  • By author, action, app or period
  • CSV export of what you filtered
  • Sign-ins: IP, browser, result
  • Access and MFA reports, in CSV or JSON
  • Evidence pack as a dated archive

Inventory

Everything inside, and what is missing.

Grey items do not exist yet. We would rather say so than leave it out.

Not yet

Members

  • Invite by email, SMS, link or QR code
  • Role chosen at invitation; adjustable expiry, 7 days by default
  • Pending invitations, bulk resend
  • Import and export members, in CSV or Excel
  • Custom fields on a member's record
  • Technical accounts for integrations
  • Suspend, deactivate, reactivate an account
  • Send a password reset link
  • Check and repair a member's access to the apps
  • Close a colleague's sessions remotely

Roles

  • Three levels: owner, administrator, member
  • Functional roles with your own names
  • Access app by app
  • Fine-grained permissions, with a recommended selection
  • A default role for new members
  • Locked system roles; a role in use cannot be deleted
  • An administrator cannot change a role equal to or above their own

Organisation

  • Units as a tree and as an org chart
  • Supervisors per unit
  • Groups filled by hand or by rules
  • Departments for routing Socials messages

Guests

  • External member, with password or invitation
  • Apps opened one by one
  • Linked to their contact record
  • Two-factor authentication can be required

Sign-in

  • Mandatory two-factor authentication, grace period
  • Allowed methods: app, email code, sign-in link
  • Security keys (WebAuthn) and recovery codes
  • Adaptive two-factor authentication
  • MFA coverage; remove MFA from a locked-out account
  • OIDC providers
  • Sign-in with Google, Microsoft or LinkedIn
  • Token-based single sign-on for your own apps
  • SAML
  • LDAP or Active Directory
  • SCIM provisioning

Passwords and sessions

  • Length and required characters
  • Common passwords refused
  • History and expiry
  • Check against leaked passwords
  • Lock after repeated failures, unlock
  • Rate limits and bot protection
  • Sign-out after inactivity
  • Everyone can close their own sessions
  • A new phone signs in with a QR code

Control and evidence

  • Security overview, status per measure
  • Activity log, kept 12 months, CSV export
  • Sign-in log
  • Reports: sign-ins, MFA, access matrix, audit
  • Evidence pack as a dated ZIP archive
  • Access reviews with a due date
  • API tokens: scopes, expiry, revocation
  • Connected apps
  • End-to-end encryption in Chat
  • End-to-end encryption in the other apps

The account

  • Name, default time zone and language
  • Welcome email
  • Sphere home page
  • Plan, seats, call-back request
  • Storage: by category, by department, by member
  • Data import and export
  • Online subscription
  • Company logo and colours
  • Export your own data from your account
  • Delete your own account
  • Linked accounts

App settings

  • Chat, Mail, Telephony, Video, Broadcast, Appointment booking
  • Drive, Notes, Calendar, Tickets, Business, HR
  • AI providers and Koukou settings per app
  • Families, entities and labels
  • Integrations and their delivery log
  • Email templates
  • External API: members and roles, guests, tickets, calls
  • Service health, presence and breaks, AI usage
  • An entry only shows if the app is in your plan

Frequently asked questions

What people ask us before opening the sphere to their team.

Your question is not here? Ask it during the demo.

Invite your team, one role each.

Settings is part of the Core, included in every plan. During the demo we set up a sphere with you, from the first invitation to two-factor authentication.