Security Controls

Admins get extra protection because they can remove members, transfer ownership and wipe photo data. The controls live under Settings > Security and are available to admins only. The tab has four cards: Admin management, Transfer ownership (owner only), Single sign-on and Multi-factor authentication.

How it works

Multi-factor authentication (MFA)

MFA adds an email code for admins. When it is on, an admin who signs in after a 24-hour gap gets a 6-digit code by email and must enter it before the admin panel opens.

1. Go to Settings > Security.
2. On the Multi-factor authentication card, toggle MFA on.
3. Click Save changes.

The admin who turns MFA on is not asked for a code right away. Their next sign-in after 24 hours triggers it.

• Codes are 6 digits and expire after 30 minutes.
• After 5 wrong attempts the code is invalid and a new one must be requested.
• A verified session lasts 24 hours.
• Members are not affected. MFA applies to admins only.

Admin management

The Admin management card lists current admins and pending admin invites. Add, remove and revoke here. See Roles and Permissions for the steps.

Transfer ownership

The owner holds the highest level of access, including billing and irreversible actions. Only the current owner sees the Transfer ownership card.

1. Go to Settings > Security as the owner.
2. On the Transfer ownership card, select the new owner. Only existing admins are listed. Add the person as an admin first if they are not.
3. Read the warning and click Transfer ownership, then confirm.
4. The new owner gets a confirmation email. They must click the link in it within 24 hours. Ownership moves when they confirm.

If the owner has left the company and cannot sign in, email support from a company address and ask for the transfer. Support needs a written request that names the organization, the old owner and the new owner. The new owner must already have a HeadshotPro account.

Data retention

The Delete all user data after 30 days setting under Settings > Headshots deletes every member's results 30 days after their last photo is generated, including edits. It is off by default.

1. Go to Settings > Headshots.
2. Toggle Delete all user data after 30 days.
3. Click Save changes and confirm.

SSO access controls

For organizations with SSO, the Single sign-on card adds:

• Require SSO login - blocks email, password and social sign-in for users on your verified domains.
• Auto-join (JIT provisioning) - lets anyone on a verified domain join without an invite.

See SSO Setup.

Good to know

• Only admins see the Security tab. Members cannot view or change these settings.
• MFA is email-only. There is no SMS or authenticator app option.
• The owner cannot be removed from the admin list. Transfer ownership first.
• Deleting the organization is a separate action. It is self-serve only when you are the only member, under Settings > General > Danger zone. Otherwise email support from the owner's address. See Organization Settings.
• The 30-day deletion applies to the whole organization. It cannot be limited to one team or one member.
• SSO organizations get Audit logs in the left menu: sign-in events with user, time and type, filterable by event and date.

Related

• Roles and Permissions
• SSO Setup
• Organization Settings
• Managing Members