Security Settings

Overview

Account Settings security options apply only to users in the account who do not have permission to view full credit card numbers. PCI Compliance standards require users who have permission to view full credit card numbers to have a session timeout of 15 minutes and a password expiration of 90 days.

Session Timeout

Session Timeout options are 8 hours.

Session Timeout options are 4 hours.

Session Timeout options are 15 minutes.

4 hours is the default.

When the specified timeout is reached, the user must re-enter their password to re-activate their session.

Expire user passwords after

Expire user passwords after 90 days.

Expire user passwords after 180 days.

Expire user passwords after 365 days.

Expire user passwords after Never.

Note that a user's password expires after that number of days, regardless of when they last logged in.

Mask date of birth field?

Mask date of birth field is a checkbox.

Selecting the mask date of birth field checkbox masks the date of birth, similar to how a password field is usually masked.

Security Settings

Full CC Number Access options may be set at the account level (Account Settings > Implementation > Products).

At the event level (Plan > Configure > Options), the corresponding options may be on or off.

If the user has both Full CC Number Access options off at the event level, then that user’s security settings are determined by the Account Settings.

If the user has either Full CC Number Access option on at the event level, then that user’s security settings are determined by PCI Compliance standards.

The value of the event level options does not affect the user’s security settings (Account Settings > Administration > Users).

Best Practices

The session timeout and password expiration options required by PCI Compliance are very restrictive and will be cumbersome to most users.

Therefore, unless access to the Full CC Numbers is absolutely required, the account Administrator should turn off the Financial and/or Accommodation modules so these Account Setting options can be utilized.

Other Settings

(Default value = not selected; that is, any user can send email.)

You can clear this check box to exclude Google Analytics.

(Default = selected, that is, Google Analytics code is included on websites and registration forms, etc.)

For full details of setting up Google Analytics in Certain, see this guide.

(Default statuses are: New, Requested Invitation, Waitlist Hold, Invited, Request Denied, Invitation Sent, Pre-Registered, Declined Invitation, Cancelled, No-show, Attended.)

You can clear this check box to hide all default statuses, in which case all events in the account can use only the custom registration statuses added on Plan > Configure > Custom Statuses.

(Default = selected; that is, all default Registration Statuses are available for use.)

Caution: If this check box is cleared, then be sure to always have custom registration statuses set up in every event, since the status is a required field on registrations.

Related articles

Comments 0 comments