Security questionnaires usually ask the same few things about a proofing tool: can staff sign in through our identity provider, can users add a second factor, and can we stop people using personal logins. This page answers those for GoProof.
With SAML single sign-on, your team signs in through your own identity provider instead of a separate GoProof password. The sign-in buttons appear on your company's own GoProof address. A user clicks the button, authenticates with your identity provider, and is returned to GoProof signed in. GoProof matches them by their email address.
Single sign-on is part of the Pro plan. Ask the GoProof team to set it up for your company address.
Some organisations want every login to go through the identity provider. If an administrator turns off all the other sign-in methods, the GoProof login page shows only the single sign-on buttons. People cannot fall back to a local password.
A passkey lets a user sign in with their device, such as a fingerprint, face unlock or screen-lock code, instead of typing a password. Users register a passkey from their security settings and can remove it later. At login they enter their email, approve the prompt on their device and they are in.
Passkeys appear only where the browser supports them, and administrators can turn them off for the company.
Users can add a second step at login, using either a code sent by email or an authenticator app. Each user gets recovery codes in case they lose access to their second factor, and can generate a fresh set. After a normal email and password login, users on paid accounts who have neither a passkey nor two-factor authentication are prompted to set one up.
People can also sign in with an existing Google, Microsoft or Slack account. Each option appears only when it is available for your company, and administrators can switch off any of them. If someone tries a provider login without a GoProof account, they are offered the chance to start signing up with their details already filled in.
Reviewers are unlimited on every plan, and only admin and member users need licences. Single sign-on applies to the people who sign in to your company's GoProof account. See whether reviewers need a paid account for how outside reviewers take part.
Oppolis, the company behind GoProof, is ISO 27001:2022 certified. The GoProof security page sets out the wider controls.
Smarter Proofing. Faster Approvals. GoProof.
Does GoProof support SAML single sign-on?
Yes. Staff sign in through your own identity provider using SAML on your company's GoProof address. Single sign-on is part of the Pro plan, and the GoProof team sets it up for your company.
Can we require single sign-on for everyone?
Yes. An administrator can turn off the other sign-in methods, and the login page then shows only the single sign-on buttons.
Does GoProof support passkeys?
Yes. Users can register a passkey from their security settings and sign in with their device. Passkeys are shown where the browser supports them, and administrators can switch them off for the company.
Can users add two-factor authentication?
Yes. Users can use a code sent by email or an authenticator app, and they receive recovery codes in case they lose access to their second factor.
Do reviewers need single sign-on?
No. Reviewers are unlimited on every plan and do not need a paid licence. Single sign-on applies to the people who sign in to your company's GoProof account.
