Customer PlaybooksAuthentication & Security — Customer Playbook

Authentication & Security — Customer Playbook

For AdtoSign Customers | How to manage login, access, and security settings

For AdtoSign Customers | How to manage login, access, and security settings

How Authentication Works

AdtoSign uses secure authentication to protect your organization's email signature management platform.

Login Methods

  • Email + Password: Standard login with secure password requirements
  • OAuth SSO: Sign in with Google or Microsoft (if configured)
  • MFA: Super-admin accounts require TOTP (Time-based One-Time Password)

Access Levels

LevelWhoWhat They Can Do
Super AdminAdtoSign staffPlatform-wide management (TOTA required)
Org AdminYour IT adminManage settings, team, signatures, deployment
MemberRegular employeesView signatures, use add-in, request reviews
Portal UserDirectory usersView own reviews at /my-reviews (no membership needed)

Managing Team Access

Inviting Team Members

  1. Go to Settings > Team
  2. Click Invite Member
  3. Enter the email address (business email recommended)
  4. Select role: Admin or Member
  5. Send invite — invitee receives email with activation link

Removing Team Members

  1. Go to Settings > Team
  2. Find the team member
  3. Click Remove — they lose access immediately
  4. Their signatures stop deploying on next sync

Changing Roles

  1. Go to Settings > Team
  2. Find the team member
  3. Edit their role (Admin ↔ Member)
  4. Save — changes take effect immediately

Security Features

Data Encryption

  • At rest: Sensitive fields encrypted with AES-256-GCM
  • In transit: All connections use HTTPS/TLS
  • Credentials: Stored in Azure Key Vault (not in database)

Session Security

  • Session cookies are HttpOnly, Secure, SameSite
  • Sessions expire automatically — users must re-authenticate
  • No credentials stored in browser localStorage

Sentry Error Reporting

  • Credentials, cookies, and API keys are scrubbed from error reports
  • No PII sent to third-party error tracking
  • Sentry is outside AdtoSign's trust boundary — data is minimized

Cloudflare Protection

  • Web Application Firewall (WAF) with managed rules
  • Rate limiting on authentication endpoints
  • Bot protection (AI bots blocked)
  • SSL/TLS strict mode enforced

Origin Lock

  • Prevents bypass of Cloudflare WAF via direct-origin access
  • Cloudflare injects verification header that app validates
  • Fails open (never takes the site down)

Troubleshooting

Can't Log In

  1. Verify email address is correct
  2. Check if using business email (free emails may be blocked)
  3. Try password reset
  4. Clear browser cookies and try again
  5. Contact your AdtoSign admin

Access Denied on a Page

  1. Check if you have the right role (Admin vs Member)
  2. Check if you're in the correct workspace
  3. Contact your admin to verify your membership

Business Email Blocked on Signup

  • AdtoSign blocks free/personal email domains (gmail.com, yahoo.com, etc.)
  • Use your business email address
  • Contact support if your business domain is being incorrectly blocked

Best Practices

  1. Use business emails: Don't use free/personal emails for AdtoSign accounts
  2. Limit Admin role: Only grant Admin to users who need to manage settings
  3. Remove departed employees: Remove team members when they leave
  4. Keep passwords secure: Use strong, unique passwords
  5. Enable SSO if available: OAuth SSO is more secure than passwords
  6. Monitor team list: Regularly review who has access
Was this page helpful?