Base Security

By default, each user will have a certain level of access to the system before they are given specific security rights. You can change their default level of access by changing this setting to Read/Write, Read Only or No Access.


Read/Write will give them the ability to read (view) and write (change) information in the system unless another security setting prevents them from doing so. This setting is very useful if most the users in the system will be reading and writing most of the data.


Read Only will give them the ability to read (view) all the information in the system unless another security setting prevents them from doing so. You can add more security settings later to give them the ability to write (change) certain information but for most information they will only be allowed to read. This is useful if the system is such where most of the information is OK for most users to view but you only want a smaller portion of users to change the information.


No Access will hide all information from them unless you specifically give them rights to certain types of information later. This is useful if most of the information is sensitive or if there are many groups of users and many types of information in the system.


Inactivity Logout 

If you wish to have the users automatically logged out after a set number of minutes they are inactive, set the number of minutes in this field. Set to 0 to use the built-in 24-hour session expiration. Once the user has been inactive for the specified number of minutes they will be logged out. 


Password Change

This is used to specify wow often (in days) to force users to change their passwords. Leave it blank or set to 0 to not force password changes. Otherwise when a user logs in after their password expiration they will be prompted to change their password.


Password Complexity

You can set this option to the level of password protection you need. The options are Low, Medium and High.


Low - No specific password requirements

Medium - Minimum password length of 6 characters

High - Minimum of 6 characters, one or more must be upper case, one or more must be lower case, and one or more must be non-alphanumeric

Custom - You can specify a custom REGEX expression that dictates the complexity required


Password Security REGEX

Set your custom REGEX expression here for password complexity


Change Password

Turning this option ON allows users to change their own password. If this is OFF then admins must manage the passwords.


Password Reset

Turning this option ON allows users to click a Forgot Password link on the login page to start the password recovery process. Turn it OFF if you do not wish to use that feature.


Remember Me

Turning this option ON allows users to check the 'Remember Me' box in the login page. By checking that box during login, the user will be automatically logged in when visiting the site again. This is done with persistent cookies so please review all security concerns around using encrypted cookies with SSL communications before using this.




Failed Logins

Whether or not to send emails to admins when a user login fails. This is useful for identifying improper access attempts.


Standard Logins

Whether or not to allow standard logins when using SSO for the normal logins. If you use SSO but still have some support logins or other non-SSO logins that need access then you can turn this on. If you want to be sure that only SSO users are allowed access, turn this off.


Auto SSO Login

Whether or not to automatically direct users to the SSO login cycle when coming to the login screen. If you turn this OFF then users will be directed to login using your SSO provider instead of having to click the Auto Login button.


SSO Login User Property

If you are using Single Sign On, this allows you to select which user property matches your SSO login main property. The default is Email which works most of the time.





Non-Admin Restore

Allows users without Admin rights to view and restore deleted Documents. Normally this is an Admin-Only feature.


Secure Individual Records

Allows for records to be secured using the @SECURE data field. This adds extra security but there is a trade off for speed. Keep this off unless you need it.


Personal Signatures

Allow users to set their personal signatures. These will be available via the annotation stamps and the signature pads from workflow, add-in or e-form signature prompts.


Public PDF Forms

DocMgt has the capability to accept external PDF forms as posts into the system. For security this is not enabled by default. If you wish to use PDF forms to post data and documents into the system turn this on.


SFTP Access (Cloud only)

IF you wish to allow users to upload documents via SFTP you will want to turn on this setting.


Add-In Downloads

Turn this on to allow Add-Ins to download files to local computers and run applications


Secure API Mode

Public E-forms and other anonymous entry points run on the server under a service account so they can read the records they need to build and process the form. That means a data-pulling variable placed on a public form runs with that account's access, and a form could pull data from Record Types the public was never meant to see. Secure API Mode is the switch that closes that gap.


Turn this ON to restrict what public (not logged in) requests may do on the server. Today it governs the record-reading variables - DMGET, DMGET2, DMGETIN, DMGETLI, DMGETCOUNT, DMGETOPTIONS, DMGETCHARTDATA, DMGETEVENTS, DMGETMAPLOCS, DMGETPROP and GETRECORDID. When one of those is resolved by a public request, it only returns data if the Record Type it reads from allows it. A Record Type allows it when any one of Public Search Access, Collaboration Portals or Public Data Pulls is turned on for that Record Type.

Blocked pulls return no data rather than an error - an empty list, a count of zero, or a blank value - so the form still renders with that piece of data missing. Logged in users are never affected and continue to be governed by their normal Record Type rights. Workflow, Add-Ins and background processing are never anonymous, so they are unaffected as well.

Before turning this on, review the public forms you have in production and note which Record Types they pull data from, then enable the appropriate access toggle on each of those Record Types. Turning Secure API Mode back off makes the whole feature dormant immediately, so it is safe to switch off if a public form stops showing data unexpectedly.

While Secure API Mode is off, the Public Data Pulls toggle is hidden on the Record Type screen, since it has no effect until this option is on.