Security settings

Settings > Security shows how your organisation's activity reaches your security team. It has three sections: Two-factor authentication, Log streaming and Report a suspected data breach. You need access to the organisation's settings to open it.

Require two-factor authentication

Two-factor authentication asks members to enter a code sent to their mobile when they open your organisation. People who sign in with your organisation's single sign-on are never asked.

The section also states the password policy. Passwords on Backed are at least 8 characters and up to 200, with no forced character mix or expiry. Every place a password is set (signing up, requesting access, accepting an invitation, resetting it and changing it from your account) checks the minimum. The ISM's passphrase control asks for a longer passphrase when a password is the only factor, so require two-factor authentication here, or use your SSO (your organisation's single sign-on), to follow it.

1. Go to Settings > Security.
2. Turn on Require two-factor authentication.
3. Under Who it covers, choose Everyone or Chosen roles. For chosen roles, tick one or more of Administrator, Assessor, Applicant and Verifier. Administrator also covers owners.
4. Set the Grace period (days), from 0 to 30. Until it ends, covered members see a reminder; after it, your organisation doesn't open for them until they set two-factor up.
5. Select Save, then Require it to confirm. You see Two-factor authentication saved.

The section shows when the setting was last changed. A member who loses their phone can be helped from the Team page with Reset two-factor; see Your team.

Log streaming

Log streaming shows whether application logs and audit entries are streamed to your security team's collector (SIEM). The platform operator sets the collector for the whole platform, so this section only reports it:

• Streaming reads Off – no collector is set or On – sent over HTTPS.
• Collector and Last successful send show where logs go and when they last arrived.
• Send test record sends one record and tells you whether it was delivered.

If streaming is off, ask the platform operator to set a collector.

Report a suspected data breach

If you think your organisation's data on Backed has been exposed, tell the Backed security team from this page. They start looking within one business hour.

1. Go to Settings > Security.
2. Under Report a suspected data breach, select Report a breach.
3. Describe What happened: what you saw, which records or people it involves, and anything you've already done.
4. Enter When you first noticed it, as a date and time in your organisation's time zone. It can't be in the future.
5. Add a Phone number (optional) if you'd like a call.
6. Select Send report.

You see Report sent with your report's Reference. Quote it if you contact the security team about the report. You also get an email confirming it was received. You can also report by email to security@backed.giving.

If the team confirms a breach that affects your organisation, your owners and the Administrators who manage organisation settings are emailed within 24 hours of it being verified.

See also

• Your account
• Audit log