Skip to main content

​
Organization security

In Settings → Security you set access, invitation and data rules that apply to your whole organization. It’s not the same as Security in an agent’s settings, where you set that agent’s domains and blocks. Owners and admins use this section; operators don’t have access. Admins can change everything except Who can invite, which only the owner can change. When you change an option, the Unsaved changes bar appears. Click Save to apply it, or Discard to go back. Exporting data doesn’t go through that bar: you request it with its own button.

​
Require two-step verification

By default, each member decides whether to turn on two-step verification in My account → Security. With Require two-step verification, in the Access card, it becomes mandatory for all members, whatever their role. The row shows how many have it today (for example, “3 of 5 members have it today”).
1

Turn on your own verification first

To require it, you need to have it turned on yourself. If you don’t, when you save you’ll see “First turn on your own two-step verification in My account › Security.”
2

Turn on the option and save

Turn on Require two-step verification and click Save.
From then on, anyone who doesn’t have it sees the Set up two-step verification screen the next time they sign in or open the panel, including if they sign in with Google or GitHub. Make sure your team has an authenticator app at hand: until they finish with Set up now, they can’t keep using the panel. The other option on that screen is Sign out. While the requirement is on, anyone who turns off their verification in My account → Security will have to set it up again to keep using the panel. If you turn the option off, each member goes back to deciding for themselves. Those who already have it keep it.

​
Sign out after inactivity

Sign out after inactivity, in the Access card, asks people to sign in again after a while without using the panel. The options are Never (the default), After 8 hours, After 24 hours and After 7 days.
  • Clicking, typing, scrolling or touching the screen in any open panel tab in that browser counts as activity.
  • It applies to all members of the organization.
  • It doesn’t interrupt ChatNorris Inbox on the phone while the person has push notifications on.

​
Allowed domains

In the Invitations card, Allowed domains limits who can be invited. Type a domain (for example, company.com) and click Add; to remove it, use the × on its tag. If the list is empty, any email can be invited.
  • The rule checks the exact domain: with company.com, an @sales.company.com email doesn’t pass. Add each subdomain you need.
  • It also applies to resending an invitation that was already pending: if its email is no longer allowed, it can’t be resent.
  • It doesn’t affect members who are already in the organization.

​
Who can invite

Who can invite, also in Invitations, has two options:
  • Owners and admins (the default).
  • Owner only: admins can no longer invite or resend pending invitations.
Operators can never invite. Only the owner can change this option, so an admin can’t undo it. These two rules don’t apply to invitations made by the ChatNorris team.

​
Conversation retention

In the Data card, Keep conversations for sets how long they’re kept: Always (the default), 24 months, 12 months or 6 months. The period counts from the last message of each conversation. Once the period is over, the conversation is deleted with its messages and attachments, and it can’t be recovered. What isn’t deleted:
  • Open conversations, however old they are.
  • Conversations linked to an external system.
  • Leads: they’re kept even if the conversation they came from is deleted.
Historical metrics that depend on the deleted conversations may go down.

​
Seven days’ notice

When you turn on retention or shorten the period, ChatNorris shows you a dialog with how many conversations would be deleted today. Click Turn on and save to confirm. Then:
  1. Owners and admins are notified by email.
  2. Nothing is deleted for 7 days. The row shows the date of the first deletion.
  3. From that date, deletion runs once a day.
Until that date you can change the period or export your data. Going back to Always cancels the deletion. Lengthening the period doesn’t need a new notice, because it doesn’t delete anything the previous period wouldn’t have deleted.

​
Export your data

In the Data card, Export organization data builds a ZIP file with leads, conversations, messages and agents in CSV. Click Request export: the file starts building right away and the button shows Preparing…. You can leave the page in the meantime. When it’s ready, you can get it with Download in the same row or from the link we email you. If it fails, the row says so, we let you know by email and you can request it again right away. Export is included in the Premium plan. On other plans, the row shows “Data export isn’t included in your plan.” and the Upgrade your plan button, and you can’t request or download it.
  • One every 24 hours: the limit is per organization, not per person. An export that failed doesn’t count toward this limit.
  • Only the person who requested it can download it: the Download button and the email are only for them. Other owners and admins see in the row who requested it and from when they can request another.
  • 24 hours to download it: the button and the email link are valid for 24 hours from when the file is ready. After that you have to request another export.
  • What it doesn’t include: attachments, the knowledge base or agent configuration. Each CSV goes up to 200,000 rows.
The link gives access to the data without asking you to sign in. Don’t forward it to people who shouldn’t see it.