Security settings

Security settings are agency-wide and live under Settings → Security. They govern the web console only: the operator app is a read-only offline reader and is not affected by anything on this page.

Two-factor authentication

Choose who must have an authenticator app set up before the console opens for them:

A covered member who has not enrolled sees an enrolment screen at their next sign-in instead of the console: scan a QR code with an authenticator app, type the first code, and they are through. Nobody is locked out by turning the policy on; they are asked to enrol. A member who has enrolled is asked for a code at every console sign-in, as before.

Platform administrators (ROK staff who operate the platform) must always use two-factor authentication, whatever your agency chooses.

Enforced by ROK, not only by the console

The policy is not just a screen in the browser. ROK's database checks every request: a staff permission — editing, publishing, managing people, settings, billing, exports, print binders, push notifications — only works from a session that has passed two-factor authentication when your policy covers staff, and always for anyone who has enrolled an authenticator, whatever the policy. A stolen password alone, used straight against ROK's API, gets the read-only access of an operator and nothing more. Read-only operator access (reading published guides in the app) is not blocked by the policy.

Idle sign-out

Off, 30 minutes or 60 minutes. After that long with no mouse or keyboard activity in the browser tab, the console signs the session out and returns to the sign-in page. Intended for shared station computers. It is per browser tab, and a laptop that was asleep is checked the moment it wakes.

Select Save security settings after changing either control. Until an administrator has saved this page once, the getting-started checklist on the dashboard lists "choose an MFA policy" as still to do.

Member enrolment

The table and the Reset button appear only for people who can also manage users — the second permission listed at the top of this page.

The table lists every member of the agency with their role (staff or operator), whether an authenticator is enrolled, and their last sign-in. A member the policy covers who has not enrolled is flagged Required, not enrolled.

Reset a member's authenticator

When a member loses the phone their authenticator was on, they cannot sign in to the console at all — there are no backup codes. Select Reset on their row and confirm. What happens next:

• Every authenticator on their account is removed. Their password is unchanged.
• They can sign in with their password alone. If your policy covers them, the enrolment screen appears and they set up a new authenticator on the new phone.
• The member is emailed that an administrator reset their two-factor authentication, naming the administrator and the agency, so a reset they did not ask for is noticed at once.
• The reset is recorded in the audit log under People & access → Audit log as "Reset two-factor authentication".

You cannot reset your own authenticator here. Manage your own from Account settings → Security; if you have lost your phone, another administrator resets it for you. A platform administrator's authenticator can only be reset by another platform administrator.

If the member also belongs to another agency, the reset is refused: "this person also belongs to another agency, so only ROK support can reset their authenticator". Their account protects their access everywhere, so one agency cannot remove it; ask them to contact ROK support, which confirms who they are first.