# Keeping accounts secure This page covers what you can check and change yourself, the protections TrialGrid applies for you, and the settings TrialGrid Ltd support sets on request. ## Reviewing your users 1. Go to your Organization home page. 2. Click the **Org Team Members** card. For each user the list shows: - whether their account is active; - their Organization Role; - how they sign in (with a TrialGrid password or through [Single Sign On](../sso.html.md#sso)), and whether they have [two factor authentication](../two_factor_authentication.html.md#two-factor-authentication) turned on; - how many failed sign-in attempts there have been since their last successful sign-in; - when they last signed in. ## Deactivating a user Open the user from the Org Team Members list, clear **User is active** and save. A deactivated user cannot sign in. Their work and the record of what they did are kept. You cannot deactivate your own account. Inviting a deactivated user to a Project switches their account back on. Anyone who can add people to a Project team can do this, so a deactivated user can become active again without you being asked. If your Organization uses Single Sign On, removing someone's access in your Single Sign On system also stops them signing in to TrialGrid. It does not stop their API tokens, because TrialGrid is not told about the change. When someone leaves, deactivate them here **and** revoke their API tokens. A token that has not been revoked works again if the account is switched back on. ## API tokens The **API Tokens** card on your Organization home page lists every API token held by users in your Organization, with when each was last used. You can revoke any of them. See [Organization API Tokens](../organizations/api_tokens.html.md#organization-api-tokens). Only users whose Organization Role includes the **API Tokens** permission can create tokens. ## Protections that apply automatically You do not need to set these up. - **Account lockout.** After 5 failed sign-in attempts in a row, the account is locked. The user is emailed a link to reset their password. - **Inactivity timeout.** A user who does nothing for an hour is signed out. They see a warning a few minutes before. Sessions are also set to end when the browser closes, though some browsers restore them. - **Unused accounts.** If your Organization has no password expiry policy, a user who has not signed in for a year must reset their password before signing in again. - **Password rules.** Passwords must meet the [password requirements](../password_requirements.html.md#password-requirements), including not reusing recent passwords. Passwords are also checked against known data breaches when the breach service responds. ## Settings TrialGrid Ltd support sets for you Email [support@trialgrid.com](mailto:support%40trialgrid.com) to: - change your Organization's password policy, such as requiring a mix of characters, a longer minimum length or expiry after a number of days; - set up [Single Sign On](../sso.html.md#sso), or let a particular account sign in without it; - make particular users change their password at their next sign-in; - change how long records are kept. See [Data retention](../data_retention.html.md); - email users when their account signs in from a new location. [Settings TrialGrid Ltd support sets for you](organization_settings.html.md#admin-guide-organization-settings) lists every one of these settings and what it does. > **See also:** [Organization Team](../organizations/team.html.md#organization-team), [Security and Permissions](../permissions_and_security.html.md#permisions-and-security) and [Privacy Policy](../privacy.html.md#privacy-policy).