> This is the Markdown of a Backed Help Centre page, https://admin.backed.giving/help/administrator/organisation/security-settings.md. Every page is listed at https://admin.backed.giving/help/llms.txt.

> This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.

`Settings > Security` shows how your organisation's activity reaches your security team. It has three
sections: `Two-factor authentication`, `Log streaming` and `Report a suspected data breach`. You
need access to the organisation's settings to open it.

## Require two-factor authentication

Two-factor authentication asks members to enter a code sent to their mobile when they open your
organisation. People who sign in with your organisation's single sign-on are never asked.

The section also states the password policy. Passwords on Backed are at least 8 characters and up to
200, with no forced character mix or expiry. Every place a password is set (signing up, requesting
access, accepting an invitation, resetting it and changing it from your account) checks the minimum.
The ISM's passphrase control asks for a longer passphrase when a password is the only factor, so
require two-factor authentication here, or use your SSO (your organisation's single sign-on), to
follow it.

1. Go to `Settings > Security`.
2. Turn on `Require two-factor authentication`.
3. Under `Who it covers`, choose `Everyone` or `Chosen roles`. For chosen roles, tick one or more of
   `Administrator`, `Assessor`, `Applicant` and `Verifier`. `Administrator` also covers owners.
4. Set the `Grace period (days)`, from 0 to 30. Until it ends, covered members see a reminder;
   after it, your organisation doesn't open for them until they set two-factor up.
5. Select `Save`, then `Require it` to confirm. You see `Two-factor authentication saved.`

The section shows when the setting was last changed. A member who loses their phone can be helped
from the `Team` page with `Reset two-factor`; see [Your team](../users/your-team.md).

## Log streaming

`Log streaming` shows whether application logs and audit entries are streamed to your security
team's collector (SIEM). The platform operator sets the collector for the whole platform, so this
section only reports it:

- `Streaming` reads `Off – no collector is set` or `On – sent over HTTPS`.
- `Collector` and `Last successful send` show where logs go and when they last arrived.
- `Send test record` sends one record and tells you whether it was delivered.

If streaming is off, ask the platform operator to set a collector.

## Report a suspected data breach

If you think your organisation's data on Backed has been exposed, tell the Backed security team from
this page. They start looking within one business hour.

1. Go to `Settings > Security`.
2. Under `Report a suspected data breach`, select `Report a breach`.
3. Describe `What happened`: what you saw, which records or people it involves, and anything you've
   already done.
4. Enter `When you first noticed it`, as a date and time in your organisation's time zone. It can't
   be in the future.
5. Add a `Phone number (optional)` if you'd like a call.
6. Select `Send report`.

You see `Report sent` with your report's `Reference`. Quote it if you contact the security team about
the report. You also get an email confirming it was received. You can also report by email to
security@backed.giving.

If the team confirms a breach that affects your organisation, your owners and the Administrators who
manage organisation settings are emailed within 24 hours of it being verified.

## See also

- [Your account](../users/your-account.md)
- [Audit log](../audit/audit-log.md)