Policies are rules an owner or admin sets for the whole team. Set them in the app (Teams, open the team, Policies, then Save policies) or on the team page at morphgate.com.
The policies
- Require two-step verification
- Members without two-step verification can still sign in and use their personal vault, but not the team's vaults, until they turn it on. Vaults already on their devices stay there meanwhile, unsynced edits included. Needs a server that offers two-step verification; morphgate.com does, the reference server doesn't yet. See Two-step verification.
- Members can create vaults
- Lets plain members create team vaults. They manage the vaults they create. Off by default: only owners and admins create vaults.
- Invite only addresses at these domains
- A list of domains, such as
example.com. Invites to other addresses are refused. Empty allows any address. - Device approval
- New devices wait for approval before they open the team's vaults. Devices in use when you turn it on stay approved. On morphgate.com this needs the Business plan. See Device approval.
- Delete the team's session logs after this many days
- The server deletes the team's session log recordings older than this, from 1 to 3650 days. 0 keeps them until someone deletes them. In the app only, on servers that store files. See Session logs.
- Require single sign-on
- The team's vaults also need a recent sign-in at the team's identity provider. It's set on the website, where the identity provider is configured; the app shows it but doesn't change it. Business plan. See Single sign-on.
What policies change, and what they don't
- Policies apply to the team's vaults only. Nobody's personal vault is affected.
- A member who doesn't meet a policy keeps the team vaults already on their devices. They just don't sync until the member complies.
- Changes to the team's name and policies are recorded in the activity log.
When the plan drops below Business
Losing a plan never quietly loosens a team's security. Device approval and single sign-on stay enforced if they were on. Admins can still turn them off, but can't turn them on again, or change single sign-on, without Business. See The Business plan.