Skip to content
Faylee Faylee Faylee

Security and SSO

This page covers how people sign in to Faylee and how admins keep track of changes to the workspace. Single sign-on, SCIM and the audit log are for workspace admins and owners. Two-factor sign-in is set up by each person for their own account.

Ways to sign in

Section titled “Ways to sign in”

People can sign in to Faylee with:

  • An email address and password.
  • Continue with Google, which accepts only addresses Google has verified.
  • Sign in with SSO, when your workspace has set up SAML single sign-on.

The extension signs in through the app, or with an email and password.

SAML single sign-on

Section titled “SAML single sign-on”

Faylee works with SAML identity providers such as Okta, Microsoft Entra ID, Google Workspace and OneLogin.

Setting it up

Section titled “Setting it up”
  1. In Faylee, open Settings, then Single sign-on.
  2. Under SAML single sign-on, copy the values Faylee gives you into a new SAML app in your identity provider:
    • Entity ID (audience)
    • Reply URL (ACS)
    • Metadata, the address of Faylee’s service provider metadata, for providers that can read it.
  3. In your identity provider, set the Name ID to the person’s email address. Faylee finds or adds people by that address.
  4. Back in Faylee, fill in Identity provider with what your provider gives you:
    • Sign-in URL, the provider’s SAML sign-in address.
    • Issuer (optional), the provider’s entity ID.
    • Certificate, the provider’s X.509 signing certificate, in PEM or base64. Once one is saved, paste a new one only to replace it.
    • Email domain, such as acme.com.
  5. Press Save.

Signing in

Section titled “Signing in”

People choose Sign in with SSO on the sign-in page and type their work email. Faylee sends anyone at the workspace’s email domain to your identity provider, then signs them in when the provider sends them back.

The first time someone signs in through SSO, Faylee adds them to the workspace as a member. Their email address counts as confirmed, because the identity provider vouches for it. Someone whose address already belongs to another Faylee workspace is refused, and has to be invited instead.

Requiring single sign-on

Section titled “Requiring single sign-on”

Turn on Require single sign-on to stop members from signing in with a password or Google, including the extension’s password sign-in. They have to use Sign in with SSO.

Owners can still sign in with a password or Google, so a problem at your identity provider never locks everyone out.

SCIM

Section titled “SCIM”

SCIM 2.0 lets your identity provider add members to Faylee and remove them when they leave.

  1. Open Settings, then Single sign-on.
  2. Under SCIM provisioning, copy the SCIM base URL. It ends in /scim/v2.
  3. Press Make a token and copy the token. It is shown only once.
  4. In your identity provider, set up SCIM provisioning with the base URL and the token as a bearer token.
Base URL:  https://app.faylee.app/scim/v2
Auth:      Authorization: Bearer <token>

Through SCIM, your provider can list and look up members, add people as members, and update their names. Deactivating or deleting someone in the provider removes them from the workspace, the same as Remove in Settings. Their recordings stay in the workspace. See Removing a member.

Make a new token replaces the token, and the old one stops working. Update your identity provider with the new one.

Two-factor sign-in

Section titled “Two-factor sign-in”

Each person can protect their own account with codes from an authenticator app. With two-factor sign-in on, Faylee asks for a code after the password or Google sign-in, and when the extension signs in with a password.

  1. Open Settings, then Security.
  2. Press Set up two-factor sign-in.
  3. Scan the QR code with your authenticator app, or type the secret into it.
  4. Type the code the app shows into Code from the app and press Turn on.
  5. Save the ten recovery codes Faylee shows. They are shown only this once.

Each code from the app works once. Each recovery code also works once, and lets you sign in if you lose your phone. The Security page shows how many recovery codes you have left.

To turn two-factor sign-in off, type a current code into Current code, to turn it off and press Turn off.

Audit log

Section titled “Audit log”

The audit log lists who changed what in the workspace, newest first. Admins read it under Settings, Audit log. Entries can’t be edited or deleted.

It records changes to:

  • Members: invitations, joining, joining by email domain, role changes and removals.
  • The invite link and joining by email domain.
  • Storage buckets.
  • Who can open a recording.
  • Moving recordings to the trash, restoring them, and deleting them for good, including deletions by retention.
  • Integrations and the issues created through them.
  • Connected browsers, tokens and agents.
  • The assistant and what it may use.
  • Recording links.
  • Privacy rules.
  • Sites for the site widget, and the domain for links.
  • Two-factor sign-in, single sign-on and SCIM tokens.
  • Webhooks and their signing secrets.
Section titled “Related”