Security Settings

Overview

The Security settings page in DOLU.ai lets you protect your account and your customers' data. Configure two-factor authentication (2FA), manage active sessions, enforce password policies, control API key access, and set team member permissions. Security is not optional for businesses handling customer conversations and CRM data — these settings help you meet compliance requirements and prevent unauthorized access.

How to Access

Dashboard → Settings → Security

From the left sidebar, click Settings, then select Security. The page is organized into five sections: Two-Factor Authentication, Session Management, Password Policies, API Key Security, and Team Permissions.

Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step when logging in. Even if someone obtains your password, they cannot access your account without the second factor.

Enabling 2FA for Your Account

1. Navigate to Settings > Security > Two-Factor Authentication.
2. Click Enable 2FA.
3. A QR code will be displayed on screen.
4. Open your authenticator app (Google Authenticator, Authy, or Microsoft Authenticator).
5. Scan the QR code with the app. A 6-digit code will appear.
6. Enter the 6-digit code in the Verification Code field on DOLU.ai.
7. Click Verify & Activate.
8. DOLU.ai will display recovery codes. Save these codes in a secure location. They are your only way to regain access if you lose your authenticator device.
9. 2FA is now active. Every login will require your password plus a 6-digit code from the authenticator app.

Recovery Codes

• You receive 10 single-use recovery codes when enabling 2FA.
• Each code can be used only once to bypass the authenticator.
• To generate new recovery codes, go to Settings > Security > 2FA > Regenerate Recovery Codes. This invalidates all previous codes.

Enforcing 2FA for All Team Members

Tenant administrators can require 2FA for every user in the organization:

1. In the Two-Factor Authentication section, toggle Require 2FA for all users.
2. Click Save.
3. Users who have not yet set up 2FA will be prompted to do so at their next login. They will not be able to proceed until 2FA is configured.

Disabling 2FA

1. Navigate to Settings > Security > Two-Factor Authentication.
2. Click Disable 2FA.
3. Enter your current password and a valid 2FA code (or a recovery code) to confirm.
4. 2FA will be removed from your account.

Session Management

Monitor and control active sessions across all devices and browsers.

Viewing Active Sessions

1. Navigate to Settings > Security > Session Management.
2. You will see a list of all active sessions with:
   • Device/Browser: e.g., Chrome on Windows, Safari on iPhone
   • IP Address: The IP address of the session
   • Location: Approximate location based on IP geolocation
   • Last Active: When the session was last used
   • Status: Current or other

Terminating a Session

1. Find the session you want to end in the list.
2. Click the Revoke button next to it.
3. The session is terminated immediately. The user on that device will be logged out.

Terminating All Other Sessions

1. Click Revoke All Other Sessions at the top of the session list.
2. Confirm the action. All sessions except your current one will be terminated.
3. This is useful if you suspect unauthorized access.

Session Timeout Configuration

Set how long a session remains valid before requiring re-authentication:

1. In the Session Settings subsection, find Session Timeout.
2. Choose a duration: 1 hour, 4 hours, 8 hours, 24 hours, 7 days, or 30 days.
3. Click Save. Inactive sessions exceeding this duration will be automatically terminated.

Password Policies

Define password requirements for all users in your organization.

Available Policy Settings

Setting	Description	Default
Minimum Length	Minimum number of characters required	8
Require Uppercase	At least one uppercase letter (A-Z)	Yes
Require Lowercase	At least one lowercase letter (a-z)	Yes
Require Number	At least one digit (0-9)	Yes
Require Special Character	At least one symbol (!@#$%^&*)	No
Password Expiry	Days before password must be changed (0 = never)	0
Password History	Number of previous passwords that cannot be reused	3

Configuration Steps

1. Navigate to Settings > Security > Password Policies.
2. Adjust each setting as needed for your organization's security requirements.
3. Click Save Policies.
4. New policies apply to the next password change. Existing passwords are not retroactively checked, but users will be required to comply when they next change their password.

API Key Security

Manage how API keys are created and used within your tenant.

API Key Policies

1. Navigate to Settings > Security > API Key Security.
2. Configure the following:
   • Maximum Keys Per User: Limit how many API keys each user can create (default: 5).
   • Key Expiry: Set an automatic expiry period for new keys (30 days, 90 days, 1 year, or Never).
   • IP Allowlist: Restrict API key usage to specific IP addresses or CIDR ranges.
3. Click Save.

IP Allowlist Configuration

To restrict API access to specific IP addresses:

1. In the IP Allowlist field, enter one IP address or CIDR range per line.
2. Examples:

   203.0.113.50
   198.51.100.0/24
   2001:db8::/32

3. Click Save. API requests from unlisted IPs will be rejected with HTTP 403.

Viewing API Key Usage

1. Navigate to Settings > Integrations > API Keys.
2. Click on a key's label to see its recent activity log, including timestamps, endpoints called, and response codes.
3. If you notice suspicious activity, revoke the key immediately.

Team Permissions

Control what each team member can see and do within DOLU.ai.

Roles

DOLU.ai uses a role-based access control (RBAC) system with the following default roles:

Role	Description
Owner	Full access to all settings, billing, and data. Cannot be removed.
Admin	Full access to all modules and settings except billing and tenant deletion.
Manager	Access to CRM, Campaigns, Appointments, Reports. Can manage team members.
Agent	Access to assigned conversations, contacts, and tickets. Cannot change settings.
Viewer	Read-only access to dashboards and reports. Cannot create or edit records.

Assigning Roles

1. Navigate to Settings > Security > Team Permissions.
2. Find the team member in the user list.
3. Click the Role dropdown next to their name.
4. Select the new role.
5. Click Save Changes.

Custom Permissions (Per Module)

For more granular control, click Custom Permissions next to a user:

1. A modal will open showing each enabled module.
2. For each module, set the access level:
   • Full Access: Can create, read, update, and delete
   • Read/Write: Can create, read, and update (no delete)
   • Read Only: Can view but not modify
   • No Access: Module is hidden from this user
3. Click Save Permissions.

Inviting Team Members

1. Navigate to Settings > Security > Team Permissions.
2. Click Invite User.
3. Enter the email address and select a role.
4. Click Send Invitation. The user receives an email with a link to set their password and join the team.
5. The invitation expires in 48 hours. You can resend it from the team list.

Tips & Best Practices

Enable 2FA for All Admin Accounts

At minimum, all users with Owner or Admin roles should have 2FA enabled. Consider enforcing it organization-wide for maximum security.

Review Sessions Regularly

Check active sessions weekly, especially if team members access DOLU.ai from shared or public computers. Revoke any sessions you do not recognize.

Use Strict Password Policies for Regulated Industries

If your business operates in healthcare, finance, or other regulated sectors, enable all password requirements including special characters and set a 90-day password expiry.

Apply Least Privilege for Team Roles

Assign the most restrictive role that still allows each team member to do their job. Agents do not need Admin access; managers do not need Owner access.

Use IP Allowlists for API Keys

If your API integrations run from known servers, lock API keys to those IP addresses. This prevents a leaked key from being exploited from other locations.

Troubleshooting

Cannot log in after enabling 2FA

• Use one of your recovery codes to bypass 2FA.
• If you have lost your recovery codes and authenticator device, contact your tenant administrator. An admin can reset your 2FA from Settings > Security > Team Permissions.

2FA code is "Invalid"

• Ensure the time on your phone is correct. Authenticator apps rely on accurate system time.
• Wait for the code to refresh (codes change every 30 seconds). Enter the code immediately after it appears.
• If the issue persists, disable 2FA using a recovery code and re-enable it with a fresh QR code scan.

Team member cannot access a module

• Check their role at Settings > Security > Team Permissions.
• Verify the module is enabled at Settings > Modules.
• Review custom permissions if set — they override the default role for specific modules.

Session terminated unexpectedly

• Your session may have exceeded the configured timeout.
• An admin may have revoked your session remotely.
• Check for IP address changes (e.g., switching from Wi-Fi to mobile data may create a new session).

API key blocked despite correct IP

• Verify the IP address in your allowlist matches the request origin exactly.
• If using a proxy or load balancer, use the proxy's outbound IP, not the server's internal IP.
• Check for IPv4 vs. IPv6 mismatches.

Password change rejected

• Ensure the new password meets all policy requirements (length, uppercase, number, etc.).
• Check that the password has not been used in the last N passwords (per the password history setting).
• Do not reuse the current password.

FAQ

Q: Is 2FA available on all plans? A: Yes. Two-factor authentication is available to all DOLU.ai users regardless of plan.

Q: Can I use SMS-based 2FA instead of an authenticator app? A: Currently, DOLU.ai supports TOTP-based 2FA (authenticator apps) only. SMS-based 2FA is less secure and not supported at this time.

Q: How many team members can I add? A: Team member limits depend on your plan. Check Settings > Billing for your current limit and usage.

Q: Can I create custom roles beyond the defaults? A: Custom roles are available on the Professional and Enterprise plans. Go to Settings > Security > Team Permissions > Manage Roles to create custom roles.

Q: What happens to a team member's data when I remove them? A: Their conversations, contacts, and records are preserved and reassigned to the team pool. The user's login access is revoked immediately.

Q: Can I see who made changes to security settings? A: Yes. All security setting changes are recorded in the Audit Log at Settings > Security > Audit Log. It shows who changed what and when.

Q: How do I export the audit log? A: Click Export in the Audit Log section. You can download logs in CSV format filtered by date range and event type.