Editing the Security Configuration

Here you can manage the security settings for your workspace.

To enhance IT security, you can limit the access to your workspace by filtering IP addresses. In addition, you can define password policies to enforce strong passwords.

The security settings apply to every user currently in the workspace and also to all future users.

Data Protection and Privacy

Here, you set how long personal information is kept after a user was removed from this workspace.

You can set how long data is saved. The minimum time is seven days.

After the set time has passed, the user's personal information is irreversibly deleted from the workspace. Content the user created is not deleted. Comments, notifications, and related feed entries no longer show the user's name or email, they show deleted user.

While this setting is not enabled, deleted users aren't anonymized.

Set Up IP Address Filtering

The IP address filter allows you to define a list of trusted IP addresses that can accessSAP Signavio Process Manager and SAP Signavio Process Collaboration Hub. Devices with unlisted IP addresses can't access the workspace even with a valid username/password combination. This setting can be useful, for example, if you want to restrict access to your workspace or SAP Signavio Process Collaboration Hub to one or more specific companies.

For specifying IP addresses, the following rules apply:

The IP address filter is based on IPv4, so IPv6 addresses cannot be added to the list of trusted IP addresses.
Only Internet IP addresses are accepted. Local area network (LAN) IP addresses can't be listed because they depend on the local network configuration.
You must specify IP addresses in classless inter-domain routing (CIDR) notation. With the CIDR suffix, you specify whether to filter for an exact IP address or a range of IP addresses. The smaller the number after the slash, the greater the range of IP addresses.

The operating administrator's IP address is added automatically, so if you are setting up the list of trusted IP addresses and are using a static IP address, you get access from your current device automatically.

To filter for IP addresses, follow these steps:

In the explorer, choose Setup Edit security configuration.
Check Activate IP Filtering.
Enter a CIDR IP address and choose Add.
The IP address is added to the list of trusted addresses.
Save your changes.

The IP address filter is active.

To remove an IP address from the list of trusted addresses, select the IP address and choose Remove.

To deactivate the IP address filtering completely, disable the option Activate IP Filtering.

Trusted Domains

To embed SAP Signavio products in an iframe using trusted domains, you have the following options:

Use one of the public trusted domains
Add workspace-specific trusted domains

Use Public Trusted Domains

Some common third-party tools use domains that are public trusted domains.

When you embed SAP Signavio Process Collaboration Hub in the following domains, no further action is required on your side:

*.atlassian.net
*.sharepoint.com

Add Workspace-Specific Trusted Domains

When you want to embed SAP Signavio Process Collaboration Hub in other third-party tools, you have to add the domains to the security configuration and adapt the URLs.

Follow these steps:

In the Explorer, open Setup> Edit security configuration.
In the section Domain policies, add the trusted domains.
Add the parameters <model ID> and ?t=<workspace_id> to the URLs used for embedding.
To enable fullscreen mode for embedded pages, add the "fullscreen" value to the allow attribute in the iframe element.

Define a Password Policy

To enforce the use of secure passwords, you can implement a password policy. This allows you to prevent access security issues even if many users have access to your workspace.

Password policy applies whenever users set a password.

To define a password policy, follow these steps:

In the explorer, click Setup > Edit security configuration.
In the section Password policies, select the requirements that passwords have to fulfill (see list Configuration options for password policy).
Save your changes.

The password policy is active and users need to choose a password that fulfills the password policy.

Configuration Options for the Password Policy

Enforce SSO login

Define whether users can log in using their email and password on the login page or whether to enforce SSO using SAML. Read more in section Single Sign-on Using SAML.
Complexity requirements

A password is accepted when it contains at least three of the following requirements:
- at least one capital letter (A to Z)
- at least one lower case letter (a to z)
- at least one number (0-9)
- at least one special character (!,§,$,%,&,?,#)
Consider user name

Users can't use their first or last name in a password, no matter if written in upper or lower case.
Consider user name (strict)

Users can't use three or more letters in the same order as in the user's first or last name in a password, no matter if written in upper or lower case.
Minimum password age

Users can't change a password, unless the specified number of days since the last change has passed.
Maximum password age

Users are prompted to change their password after the specified number of days has passed

We recommend to set a maximum password age.
Minimum password length

Define the minimum length of a password. Usually, longer passwords are more secure than shorter ones.
Maximum password length

Define the maximum length of a password.
Password history

Users can't reuse passwords immediately. For example, if the number is set to 5, the last 5 used passwords can't be set as a new password.

Locked User Accounts

User accounts get locked after 10 failed log-in attempts with an incorrect password.

Accounts are only locked temporarily and are unlocked automatically after 30 minutes.

SAP Support

For more information, you as an S-user can contact SAP Support by creating a support case in SAP for Me. For more information, see Reporting an Issue in the SAP Signavio Support Guide.