# Security

> Choose how people may sign in to your By Dawn organization, require a passkey, decide how By Dawn staff access is approved, and keep or delete session transcripts.

This page helps you decide how people get into your organization and what By Dawn keeps of their sessions. By the
end you'll know what each card in **Settings › Organization › Security** does, and what changing
it does to people who are already signed in.

Security is for owners and admins: members don't see it. Admins can read every card, but only the owner can
change them. Each card says so for an admin, such as "Only the organization owner can change the sign-in
policy." The cards, in order, are **Sign-in policy**, **Require a passkey**, **External access (bridge
policy)**, **API keys** and **Session transcripts**. [API keys](https://docs.bydawn.com/api-keys/) have a page of their own. So does the
**AI agents (MCP)** card, which lets members connect their own AI agents: see [AI agents (MCP)](https://docs.bydawn.com/ai-agents/).

## Sign-in methods

**Sign-in policy** lists "Which methods people may use to sign in to this organization", each with a switch:

| Method | What it is |
| --- | --- |
| **Passkeys** | Touch ID, a security key, or a phone. |
| **GitHub** | Sign in with a linked GitHub account. |
| **Google** | Sign in with a linked Google account. |
| **Magic link** | A one-time sign-in link, emailed. |
| **Email code** | A one-time numeric code, emailed. |
| **Single sign-on (OIDC)** | Your identity provider, over OpenID Connect. |
| **Single sign-on (SAML)** | Your identity provider, over SAML 2.0. |

Every method starts on. A switch saves as soon as you flip it, and the last method that's on can't be turned
off, because people need some way in. The single sign-on methods also need a connection to your identity
provider, which you set up in [Single sign-on](https://docs.bydawn.com/sso/).

By Dawn checks the policy every time someone opens your organization, not only when they sign in. So when you turn
a method off, people who signed in with it are turned away on their next click, and asked to sign in another
way, such as "Your organization doesn't allow Google sign-in. Use an email code instead." They stay signed in
to any other organization that allows it.

> **Don't lock yourself out:** By Dawn doesn't check whether *you* can still get in after a change. Before you turn a method off, sign in with one
> you're keeping, for example by adding a passkey to your account.

## Require a passkey

**Require a passkey** makes everyone in the organization use a passkey: "Every member must sign in with a
passkey to use this organization. Single sign-on through your identity provider counts too." Passkeys are
phishing-resistant, so a stolen email code or Google password isn't enough to get in.

It depends on your organization's plan. If the plan doesn't include it, the card says "Requiring a passkey for
every member isn't on your plan. Members can still add passkeys themselves."

1. Sign in with your own passkey first. By Dawn won't let you require one while you're signed in another way,
   because you'd lock yourself out: it says "Sign in with your passkey first, so requiring one can't lock you
   out." and offers **Sign in with your passkey**.

2. Turn on **Require a passkey for every member**.

3. Read the confirmation and choose **Require passkeys**.

On their next request, anyone signed in with an email code, a magic link, Google or GitHub sees that your
organization requires a passkey. Someone with a passkey chooses **Sign in with your passkey**. Someone without
one chooses **Add a passkey**, then signs in with it. A session through your active
[single sign-on](https://docs.bydawn.com/sso/) connection already counts, so those people aren't asked.

If your plan stops including it, the requirement isn't enforced any more. The card then says "Your plan no
longer includes this, so it isn't enforced. Turn it off, or upgrade to enforce it again." Turning it off always
works, whatever your plan.

## By Dawn staff access

**External access (bridge policy)** decides "How on-behalf-of access from outside the organization is
approved". That's access By Dawn's own staff get to act in your organization, for example while helping you with
a support request.

| Option | What happens |
| --- | --- |
| **Require approval** | Every external bridge grant waits for an owner to approve it. |
| **Auto-approve, notify** | Grants apply immediately, but owners are notified each time. |
| **Open** | External bridge grants apply immediately, with no approval or notice. |

Organizations start on **Open**. The app doesn't list these grants yet, so pick **Auto-approve, notify** or
**Require approval** if you want to hear about each one.

## Session transcripts

**Session transcripts** decides whether By Dawn keeps the log of each agent session after the agent stops. A
transcript is end-to-end encrypted.

- **Store transcripts** keeps them. It starts off.
- **Keep transcripts for** sets how many days By Dawn keeps each one, from 1 to 365, and starts at 30. Your plan may
  allow fewer, and the card says so: "Your plan allows up to" a number of days. If your plan changes to allow
  fewer, older transcripts are deleted to match.
- **Serve on demand when storage is off** lets someone open a finished session's log straight from the machine
  it ran on, without By Dawn keeping a copy: "Stream a finished session from its machine. Nothing is kept." It
  starts on.

A project can narrow these for itself, such as keeping its transcripts for fewer days, but never widen them:
its admins do that in the project's **Transcripts** settings.

The card shows how much space your transcripts use. **Delete all transcripts** deletes every stored
transcript in the organization after you confirm. It can't be undone.

Only the owner's changes save here. An admin can move the controls, but By Dawn refuses the change.

## FAQ

**Someone can't sign in after I changed the policy. What happened?**

They're using a method you turned off. They see which methods to use instead. Turn the method back on if you
need to, or help them add a passkey.

**Does requiring a passkey affect API keys or agents?**

No. It applies to people signing in. [API keys](https://docs.bydawn.com/api-keys/) and the machines your agents run on sign in their
own way.

**Can I turn off everything except single sign-on?**

You can, but think about who it leaves out. Single sign-on only signs in people whose email is at one of your
[verified domains](https://docs.bydawn.com/sso-domains/), so contractors and anyone else with another email couldn't get in at all.
For most organizations, offering single sign-on (**Enforcement** at **Optional**) and keeping
**Passkeys** on is the safer choice.

## Where to go next

- [API keys](https://docs.bydawn.com/api-keys/): let scripts and services use the board API.
- [Single sign-on](https://docs.bydawn.com/sso/): sign people in through your identity provider.

Source: https://docs.bydawn.com/security/