Security: MFA & SSO

Protect console access with TOTP multi-factor authentication and SAML single sign-on.

Multi-factor authentication (TOTP)

Each member enables MFA from their own profile (Account → Security → Two-factor authentication). Org admins can see whether a member has MFA enabled in the team list.

1. Enroll — click Set up authenticator, scan the QR code with any TOTP app (Google Authenticator, Authy, 1Password…), and save the recovery codes.
2. Activate — enter a one-time code from the app to confirm enrollment.
3. Sign-in — after the Google sign-in step, the console challenges for the current TOTP code.
4. Remove — go to the same screen and click Remove (requires a current TOTP code to confirm).

SAML single sign-on

SAML SSO is configured at the org level by an OWNER. Once active, members whose email domain matches are redirected to your identity provider instead of the Google sign-in screen.

1. Go to Team → Security → Single sign-on → Configure SAML.
2. Paste your IdP's metadata XML or metadata URL.
3. Register Tripticonsent as a Service Provider in your IdP using the details below.
4. Save and test with a non-owner account before enforcing SSO for all members.