<h2>Separate databases, full encryption</h2>
Each company’s data in Pipedrive is stored in a separate database. This avoids any risk of unwanted leaks into another company’s database. The Pipedrive application employs only secure HTTPS connections, where all information is encrypted. 
<h2>Daily backups, and backups of backups</h2>
We store backups of your important data, so we can restore your information upon request. All backups of Pipedrive data — no matter where you are — are done through Amazon Web Services. This means your data is safely stored around the globe every day. To read more about our backup systems, click <a href="https://support.pipedrive.com/en/article/how-is-data-backed-up-in-pipedrive" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="207450685">here</a>. 
<h2>World-class infrastructure </h2>
For optimized performance and compliance, the Pipedrive databases of users in Europe, Africa, India, Israel, Turkey, and Kazakhstan are hosted in Frankfurt while data from users in other countries is stored in data centers in the United States. 
<h2>Perfect privacy</h2>
Your sales data is important and should belong to you and you alone. No Pipedrive employee can see the specific content of your database without your permission.

How secure is my data in Pipedrive?

25 May 2018 marks the start of enforcement of the <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679" target="_blank">European Union’s General Data Protection Regulation</a>. This new piece of legislation has had a great impact on anyone whose business involves handling personal data about EU residents or within the EU. Naturally, personal data is at the core of working in sales, so Pipedrive and our users have also been busy to make sure that we are compliant. This article provides an overview of the data-related roles and responsibilities when you’ve chosen Pipedrive as your CRM platform and will explain Pipedrive’s efforts to live up to the values and requirements of the GDPR.
<hr>
<h2>
<a name="pipedrive-as-the-data-processor"></a>Pipedrive as the data processor</h2>
The people you store in Pipedrive as Contacts are your data subjects, and you are considered the data controller for this personal data. In our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank">Terms of Service</a> and <a href="https://www.pipedrive.com/en/privacy" target="_blank">Privacy Policy</a>, we refer to this data as Client Data. Using the Pipedrive app to manage your customers means that you have engaged Pipedrive as a data processor to carry out certain processing activities on your behalf. According to Article 28 of the GDPR, the relationship between the controller and the processor needs to be made in writing (electronic form is acceptable under subsection (9) of the same Article). 
This is where our <a href="https://www-cms.pipedriveassets.com/documents/2021-02-16-Pipedrive-DPA-Signed.pdf" target="_blank">Data Processing Addendum</a>, <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank">Terms of Service</a> and <a href="https://www.pipedrive.com/en/privacy" target="_blank">Privacy Policy</a> come in. These three documents serve as your data processing contract, setting out the instructions that you are giving to Pipedrive with regard to processing the personal data you control and establishing the rights and responsibilities of both parties. Pipedrive will only process your Client Data based on your instructions as the data controller. 
Lastly, it is important to check Section 18.1 of our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank">Terms of Service</a> to see which Pipedrive entity is your contractual partner. All EU customers have a contractual relationship with our EU entity, based in Estonia. 
<hr>
<h2>
<a name="data-transfers"></a>Data transfers</h2>
One topic that often comes up with customers is data transfers outside of the EEA. The GDPR establishes strict requirements for moving data outside of its scope of protection. This is only natural - otherwise it would be impossible for the law to fulfill its purpose. Who is responsible for meeting these data transfer requirements? As our EU customers have a legal relationship with our EU entity, this data transfer remains within the EEA. If Pipedrive subsequently engages sub-processors outside the EEA, it is our job to ensure that we transfer the data lawfully. We will keep an up-to-date list of sub-processors in our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank">Terms of Service</a> to be fully transparent about these transfers. This list will also explain what data is involved and how we have ensured that the data is adequately protected even after it leaves the EEA. We do this by making sure that our third-party service providers have either certified under the EU-US Privacy Shield framework or signed the EU Commission’s standard contractual clauses for data transfers with us. 
<hr>
<h2>
<a name="pipedrive-as-the-data-controller"></a>Pipedrive as the data controller</h2>
Additionally, Pipedrive acts as the data controller for the personal data we collect about you, the user of our web app, mobile apps, and website. First and foremost, we process data that is necessary for us to perform our contract with you (GDPR Article 6(1)(b)). Secondly, we process data to meet our obligations under the law (GDPR Article 6(1)(c)) — this primarily involves financial data and information that we need to meet our accountability obligations under the GDPR. Thirdly, we process your personal data for our legitimate interests in line with GDPR Article 6(1)(f). What are these ‘legitimate interests’ we talk about?
<ul>
<li>Improving the app to help you reach new levels of productivity.</li>
<li>Making sure that your data and Pipedrive’s systems are safe and secure.</li>
<li>Responsible marketing of our product and its features. </li>
</ul>
Hopefully this helps you to better navigate the EU’s data protection requirements. If you have any questions with regard to the above, you’re welcome to reach out to us at <a href="https://support.pipedrive.commailto:support@pipedrive.com" target="_blank" data-type="zendeskArticle" data-language="en">support@pipedrive.com</a> and we’ll do our best to explain things further. 
<hr>
<h2>
<a name="what-is-pipedrive-doing-for-the-gdpr"></a>What is Pipedrive doing for the GDPR</h2>
As a company with roots in Europe, Pipedrive is very much up to speed with the implications that the EU General Data Protection Regulation has for businesses. We appreciate the privacy needs of Pipedrive users as well as their customers and, as such, have implemented — and will continue to improve — technical and organizational measures in line with the GDPR to safeguard the personal data processed by Pipedrive. 
<hr>
<h2>
<a name="internal-processes-security-and-data-transfers"></a>Internal processes, security and data transfers</h2>
A large part of GDPR compliance is making sure that there are procedures in place that ensure that data processes are mapped and auditable. We have added elements to our application development cycle to build features in accordance with the principles of Privacy by Design. Any access to the Client Data that we process on your behalf is strictly limited. Our internal procedures and logs make sure that we meet the GDPR accountability requirements in this regard. We have established a process for onboarding third-party service providers and adopting tools that makes sure that these third-parties meet the high expectations that Pipedrive and its customers have when it comes to privacy and security. We have further launched a datacenter in Germany to store the databases of EU customers to improve performance and provide additional assurance that your data enjoys the level of protection envisioned by the GDPR. 
<hr>
<h2>
<a name="readiness-to-comply-with-subject-access-requests"></a>Readiness to comply with subject access requests</h2>
Data subjects’ ownership of their personal data is at the heart of the GDPR. We have created a readiness to respond to data subject requests to delete, modify, or transfer their data. This means that our Customer Support Specialists along with the Engineers that assist them in their work are well-prepared to help you in any matters involving your personal data, in addition to providing the awesome customer support experience that you are accustomed to. 
<hr>
<h2>
<a name="documentation"></a>Documentation</h2>
Our <a href="https://www.pipedrive.com/en/terms-of-service" target="_blank">Terms of Service</a> and <a href="https://www.pipedrive.com/en/privacy" target="_blank">Privacy Policy</a> are constantly being revised to increase transparency and to make sure the documents meet GDPR requirements. As these are the basis for our relationship for you, it is very important for us to comprehensively and openly explain our commitments and your rights in these documents. Additionally, we’re constantly mapping all our data processing activities to be able to comply with the GDPR accountability requirements. 
<hr>
<h2>
<a name="training"></a>Training</h2>
All of the above is supported by extensive training efforts within the company so that the GDPR compliant processes we’ve put in place are followed. Sessions on data privacy and security are an integral part of our onboarding process and each department receives training that is tailored to their work involving personal data. Pipedrive is firmly convinced that meeting GDPR requirements is much more than just checking off boxes in a list. For us, the GDPR is truly a lifestyle of respect to individuals’ privacy and responsibility in handling personal data.

Pipedrive and GDPR

pipedrive-as-the-data-processor

Pipedrive as the data processor

data-transfers

Data transfers

pipedrive-as-the-data-controller

Pipedrive as the data controller

what-is-pipedrive-doing-for-the-gdpr

What is Pipedrive doing for the GDPR

internal-processes-security-and-data-transfers

Internal processes, security and data transfers

readiness-to-comply-with-subject-access-requests

Readiness to comply with subject access requests

documentation

Documentation

training

Training

How is the data in Pipedrive stored? How reliable are the backups of users’ data? 
<ul>
<li>
Pipedrive has database replicas that sync the databases in real time. This means that if something should happen to one of the main database machines, the backup can be switched to quickly ensure continuity of service and no loss of data.</li>
<li>
Pipedrive conducts nightly complete backups of all the database machines. These backups can be used to recover data in the event of data corruption. This is used in the event that the database machines are intact, but the data has somehow been corrupted in both the main machines and the replicas.</li>
<li>
Pipedrive also creates nightly backup files of all the customer databases, encrypts them, and stores them securely off-site. 
</li>
</ul>
To create a local Pipedrive data back up, simply go to "..." (More) &gt; <a href="https://app.pipedrive.com/settings/export">Export Data</a> from the left sidebar menu. From there, generate a spreadsheet of the information you wish to export, and then download it to your computer.

How is data backed up in Pipedrive?

<div class="support-note primary">
Note: Each user can have up to three devices logged into the same user account. </div>
 Since company Pipedrive accounts contain your valuable information, Pipedrive will automatically log you out after a certain period of inactivity. To remain logged in for a longer period of time, be sure to check the Remember me option when logging in. When the Remember me option is checked — or when logging in using Google credentials or with SSO — Pipedrive login sessions will last for thirty days. When not selected, login sessions will last for twelve hours, or until the internet browser is closed. 
However, you do not need to worry about being logged out in the middle of your work. Pipedrive will keep you logged in and extend your session if you're still in the middle of working. 
<div class="support-note primary">
Note: To help maintain the overall security of your Pipedrive user account, we suggest being vigilant and checking your <a href="https://support.pipedrive.com/en/article/how-can-i-log-myself-out-of-pipedrive-on-my-connected-devices" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360001078097">active device login sessions</a>, as well as your <a href="https://support.pipedrive.com/en/article/how-can-i-see-which-devices-i-have-used-to-access-pipedrive" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360001086418">device login history</a> for your account.</div>

Why does Pipedrive log me out?

Data Security in Pipedrive

<div class="support-note primary">
Note: The Security rules feature is one of the many useful features of Pipedrive's Enterprise plan. Only Admin users can set up Security rules in a company account. 
</div>
 Keeping data safe is essential for any business. With the Security Rules feature, Admin users of a Pipedrive company account can enforce access restrictions to ensure that business data is only available to the right people at the right place and time.
To access and set up your Security rules, go to Settings &gt; Security center &gt; <a href="/settings/security-rules">Rules</a>. 
<h2><figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-08-25_at_4.32.02_PM.png" alt="Screen_Shot_2020-08-25_at_4.32.02_PM.png" width="959" height="663" data-image="bu5u1aigleo7"></figure></h2>
<div class="support-note success primary">Note: With an exception of Two-factor authentication, Security Rules will not apply when accessing Pipedrive through the Mobile App. </div>
<hr>
<h2>
<a name="two-factor-authentication-2-fa"></a>Two-factor authentication (2FA)</h2>
You can toggle this option on to enforce <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000808405">Two-factor authentication (2FA)</a> for all users. The 2FA feature protects your Pipedrive user account by sending users an email with a click-to-verify link the next time you log in. Each user will only need to be verified every 30 days on each device. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-15_at_1.36.49_PM.png" alt="Screen_Shot_2020-01-15_at_1.36.49_PM.png" width="600" height="125" data-image="fy7gkp6ajgas"></figure>
<hr>
<a name="C2IamCs"></a>
<h2>Password strength<a name="password-strength"></a></h2>
When an admin user enforces password strength requirements, any users with passwords that do not fulfill those requirements will be asked to change their password the next time they log in. You can make sure user passwords have one or more of the following:
<ul>
<li>At least one lowercase and one uppercase letter</li>
<li>At least one number</li>
<li>At least one special character ( '!', '@', '&amp;', etc.)</li>
<li>A minimum amount of characters (must be at least 8)</li>
</ul>
<figure><img src="https://kb-cms.pipedriveassets.com/passwordstrength.gif" alt="passwordstrength.gif" width="599" height="224" data-image="5q0j208kdb3q"></figure>
<h2> </h2>
<hr>
<a name="C3IamCs"></a>
<h2>Password expiration and reuse<a name="password-expiration-and-reuse"></a></h2>
A password expiration date or password reuse condition can be set up for your users' passwords. 
<ul>
<li>
Password expires— Your users' passwords can be set expire every 365 days, 180 days, 90 days, 60 days, 30 days, or never.</li>
<li>
Password reuse— Password resets can be limited to forbid just the current password or current password and one previous password 
</li>
</ul>
<figure><img src="https://kb-cms.pipedriveassets.com/passwordexpirationandreuse.gif" alt="passwordexpirationandreuse.gif" width="600" height="282" data-image="wb3o6t9823t8"></figure>
<hr>
<a name="C4IamCs"></a>
<h2>Advanced rules<a name="advanced-rules"></a></h2>
When you expand the Advanced rules section, you will be able to set up more sophisticated security rules to limit user access. 
Note: Once enforced, Advanced rules will immediately apply for all regular users. All Admin users will not be affected. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-15_at_1.36.18_PM.png" alt="Screen_Shot_2020-01-15_at_1.36.18_PM.png" width="599" height="160" data-image="fqsh629wqdvj"></figure>
 Allow access only for specific IP addresses If you want your users to only access Pipedrive when they are in specific locations, you can add IP address conditions to your advanced security rules. Regular users will then only have access to company data when they are under these IP addresses. Click on Add IP address to get started. 
In the Add IP window, you will see the option to either type in an IP address or autofill your current IP address. You can add more than one IP address depending on your access limitation requirements.
<figure><img src="https://kb-cms.pipedriveassets.com/addipaddress.gif" alt="addipaddress.gif" width="600" height="223" data-image="se8cqjo8we7q"></figure>
Allow access at only at specific times Enabling this rule will restrict user access to specific time frames, such as company working hours or a timezone. Regular users will lose access to Pipedrive outside of the days, time, and time zone that is added by the Admin user. 
You can click on Add time range to set up your time range restrictions. 
<figure><img src="https://kb-cms.pipedriveassets.com/timeframe.gif" alt="timeframe.gif" width="599" height="350" data-image="omavn3pm76sz"></figure>
 
<hr>
<a name="C5IamCs"></a>
<h2>Confirming and validating your changes<a name="confirming-and-validating-your-changes"></a></h2>
Once all of the rules are set up, you can click on Preview and enforce to validate your changes. Confirm your security rule details in the window that appears and click on Enforce now to implement your rules. 
You can choose here to send a summary of the changes made to your users. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-17_at_5.28.57_PM.png" alt="Screen_Shot_2020-01-17_at_5.28.57_PM.png" data-image="kqnxait8ejvr"></figure>

Security Rules

two-factor-authentication-2-fa

Two-factor authentication (2FA)

password-strength

Password strength

password-expiration-and-reuse

Password expiration and reuse

advanced-rules

Advanced rules

confirming-and-validating-your-changes

Confirming and validating your changes

<div class="support-note success primary">Note: The Security rules feature is one of the many useful features of Pipedrive's Enterprise plan. </div>
If you see any of the following access restriction prompts or errors when trying to log into Pipedrive, your Admin user has set up <a href="https://support.pipedrive.com/en/article/security-rules" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360004510857">Security Rules</a> to restrict user access in your company account. We recommend reaching out to an Admin user for more information on these restrictions.
<div class="support-note success primary">Note: With an exception of Two-factor authentication, Security Rules will not apply when accessing Pipedrive through the Mobile App.</div>
<hr>
<h2>
<a name="two-factor-authentication-verification"></a>Two-factor authentication verification </h2>
When the <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000808405">Two-factor authentication</a> security rule has been applied, all users will receive a verification notice the next time they try to log into Pipedrive. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.17.26_AM.png" alt="Screen_Shot_2020-01-20_at_11.17.26_AM.png" width="600" height="462" data-image="yt7080gyjofh"></figure>
<hr>
<h2>
<a name="password-strength-requirements"></a>Password strength requirements</h2>
If a Password strength rule is set up, all Admin and Regular users will be prompted with a Reset your password window according to those rules the next time they try to log into Pipedrive: 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.42.37_AM.png" alt="Screen_Shot_2020-01-20_at_11.42.37_AM.png" width="600" height="218" data-image="iqlush7eqft1"></figure>
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.45.14_AM.png" alt="Screen_Shot_2020-01-20_at_11.45.14_AM.png" width="600" height="637" data-image="pv88tz4vf2bf"></figure>
<hr>
<h2>
<a name="password-expiration-and-reuse"></a>Password expiration and reuse </h2>
Once an Admin user sets up any Password expiration and reuse rule, all Admin and Regular users will be prompted to reset their password according to those rules the next time they try to log in. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_12.02.24_PM.png" alt="Screen_Shot_2020-01-20_at_12.02.24_PM.png" width="603" height="182" data-image="jmed7yaqdqxu"></figure>
Depending on the condition set up under Password expires, you will be brought to a Reset your password window after that time frame passes. 
If the new password entered does not fulfill the requirement set up under Password reuse, you will see an error such as 'New password cannot be the same as the current password', or 'New password cannot be the same as previous password', depending on the condition set up. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_11.58.44_AM.png" alt="Screen_Shot_2020-01-20_at_11.58.44_AM.png" data-image="bqcijzltxpjc"></figure>
<hr>
<h2>
<a name="advanced-rules"></a>Advanced rules </h2>
Advanced rules restrictions will be applied to only regular users when trying to access Pipedrive outside of a specific time frame or location specified. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.12.25_PM.png" alt="Screen_Shot_2020-01-20_at_2.12.25_PM.png" width="600" height="189" data-image="86lk81isajz8"></figure>
If an IP address restriction is set up, a regular user who tries to log into Pipedrive from a location not specified will see this access restricted notice when trying to log in: 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.05.49_PM.png" alt="Screen_Shot_2020-01-20_at_2.05.49_PM.png" width="600" height="317" data-image="klxwab4f5ey4"></figure>
If a time range access restriction is set up, a regular user who tries to log into Pipedrive from outside of the time frame will see this access restricted notice when trying to log in: 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.06.23_PM.png" alt="Screen_Shot_2020-01-20_at_2.06.23_PM.png" width="601" height="303" data-image="94z833p6dw59"></figure>

Security Rules access restrictions

two-factor-authentication-verification

Two-factor authentication verification

password-strength-requirements

Password strength requirements

<div class="support-note success primary">Note: This can only be set up by the admin user in both Azure AD and your Pipedrive account.</div>
Pipedrive's <a href="https://support.pipedrive.com/en/article/single-sign-on">Single Sign-on (SSO)</a> feature integrates with Azure AD to ensure that your team can access Pipedrive easily using your identity provider.
<hr>
<a name="C1"></a>
<h2>Install an app and assign a user<a name="install-an-app-and-assign-a-user"></a></h2>
The first step for you to set up Pipedrive SSO with Azure AD is to install an app. Go to your Azure Portal, and in Azure AD add a new application.
To do this, go to the sidebar on the left-hand side of the page, and select Enterprise applications - New application, and search for Pipedrive.
<figure><img src="https://kb-cms.pipedriveassets.com/Screen%20Capture%20on%202021-03-23%20at%2013-34-59.gif" data-image="13105" alt="Azure AD select PD"></figure>
You can rename the app if you wish, Pipedrive XYZ in the example below. Next, click Create.
<figure><img src="https://kb-cms.pipedriveassets.com/Pipedrive%20XYZ.png" data-image="13107" alt="Pipedrive XYZ"></figure>
Click into your new app in Azure AD, and add yourself to the app by clicking on the Assign Users and groups option. To start, add yourself to the account.
<div class="support-note success primary">Note: The first user added to Azure AD should be an admin user in Pipedrive and Azure AD. </div>
<figure><img src="https://kb-cms.pipedriveassets.com/Azure%20getting%20started.png" data-image="12961" alt="Azure getting started"></figure>
<hr>
<a name="C2"></a>
<h2>Configuring SSO<a name="configuring-sso"></a></h2>
Once you have added yourself to the application, click on the Single-sign-on-option &gt; SAML.
<figure><img src="https://kb-cms.pipedriveassets.com/SSO%20SAML.png" data-image="13109" alt="SSO SAML"></figure>
In your Pipedrive account, go to Settings - Security Centre - <a href="app.pipedrive.com/settings/sso" target="_self">Single sign on</a><a>.</a><a href="app.pipedrive.com/settings/sso" target="_self"></a>
<figure><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-23%20at%2016.10.45.png" data-image="13125" alt="SSO SLO-Removed"></figure>
 
In Azure, go to the Single-Sign-On &gt; SAML section of your Pipedrive app settings, and copy and paste the values from your Pipedrive web app settings page.
You should first match the values from the Metadata URL in Pipedrive to the Azure AD Identifier, as well as Pipedrive's Single sign-on (SSL) URL to Azure's Reply URL.
<figure><img src="https://kb-cms.pipedriveassets.com/SAML.png" data-image="12966" alt="SAML"></figure>
<figure><img src="https://kb-cms.pipedriveassets.com/SAML%202.png" data-image="12968" alt="SAML2"></figure>
 
Next, in Azure AD you will need to add your User Attributes &amp; Claims.
<figure><img src="https://kb-cms.pipedriveassets.com/UA%20CLAIMS.png" data-image="12969" alt="User A Claims"></figure>
Once done, you should then copy the App Federation Metadata Url from Azure, and paste it to the Issuer field in Pipedrive.
<figure><img src="https://kb-cms.pipedriveassets.com/SAML%203.png" data-image="12970" alt="SAML3"></figure>
<figure><img src="https://kb-cms.pipedriveassets.com/SSo.png" data-image="12971" alt="SSO"></figure>
 
Next, you will need to download the Certificate (Base64) from Azure AD. Once downloaded, open the certificate in any text editor and copy and paste the text to the X.509 certificate field in your Pipedrive SSO settings page.
<figure><img src="https://kb-cms.pipedriveassets.com/cert.png" data-image="12972" alt="SAML Cert"></figure>
<figure><img src="https://kb-cms.pipedriveassets.com/Cert%20Blur.png" data-image="12973" alt="Cert blur"></figure>
You will then need to match your Login Url from Azure, to the Single sign-on (SSO) url in Pipedrive. 
<figure><img src="https://kb-cms.pipedriveassets.com/Login%20URL.png" data-image="13130" alt="Login URL"></figure>
<figure><img src="https://kb-cms.pipedriveassets.com/SSO%20url.png" data-image="13127" alt="SSO url"></figure>
 
<hr>
<a name="C3"></a>
<h2>Testing the SSO setup<a name="testing-the-sso-setup"></a></h2>
The next step is for you to test your SSO setup. In your Pipedrive SSO settings page, click on Test. If the setup has been successful, you should see the following message - "SSO login test successful! Enable SSO/SAML for users?"
<div class="support-note success primary">Note: You should not click Enforce SSO login yet.</div>
 You can now select Enable for users in order to enable the feature. You should then logout from Pipedrive, go to your Office 365 account home page, and select your Pipedrive app from your list.
This will initiate an IDP login, and if you are logged in successfully, your SSO has been set up correctly. 
If you would like your team to start using SSO, you can go to your Pipedrive SSO settings page and click Enforce SSO login.
<div class="support-note success primary">Note: For additional information on setting up SSO with Azure AD, you can <a href="https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/pipedrive-tutorial">read this article.</a></div>

Using Pipedrive Single sign-on with Azure AD

install-an-app-and-assign-a-user

Install an app and assign a user

configuring-sso

Configuring SSO

testing-the-sso-setup

Testing the SSO setup

<div class="support-note primary">Note: Some Security Dashboard features are only available on Pipedrive's Enterprise plan. The Security Dashboard is only visible by default to admin users. Visibility of the Security Dashboard for regular users can be turned on by Admin Users under <a href="https://support.pipedrive.com/en/article/permission-sets" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000309478">permissions. </a></div>
 Data security is one of the most important components of any customer-facing business. With the Security Dashboard feature, you will be given full transparency of user access and security-related activity in your Pipedrive company account, as well as tips on how to improve the security settings of your data.
<figure><img class="vidyard-player-embed" src="https://play.vidyard.com/yuQ3VmWMHPbYPkTFc6Gdt2.jpg" data-uuid="yuQ3VmWMHPbYPkTFc6Gdt2" data-v="4" data-type="inline" data-image="7qn7lhqkuoi4"></figure>
 To see the Security Dashboard of your Pipedrive company account, go to Settings &gt; Security center &gt; <a href="/settings/security-dashboard">Dashboard</a>. 

<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-08-25_at_4.26.34_PM.png" alt="Screen_Shot_2020-08-25_at_4.26.34_PM.png" width="826" height="577" data-image="e6pevksyxgev"></figure>
 In the first section of your dashboard, you will be able to see information related to user access in your Pipedrive company account. You can hover over and click each of the sections to see more information.
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_1.38.10_PM.png" alt="Screen_Shot_2019-06-04_at_1.38.10_PM.png" width="501" height="242" data-image="9qsdui7axcq3"></figure>
<hr>
<h2>
<a name="right-now"></a>Right Now
</h2>
<ul>
<li>
Users logged in— A list of users logged into your Pipedrive company account at that moment and their locations. You can also see the number of offline users and the time they were logged out.
</li>
<li>
Unique locations— The number of devices logged in by location, in descending order.
</li>
</ul>
 To find out more about the devices and users currently logged into your company account, you can click on the Active devices section in the bottom section of the dashboard. 
<hr>
<h2>
<a name="last-7-days"></a>Last 7 days
</h2>
<div class="support-note success primary">Note: This is available on all Pipedrive plans.</div>
<ul>
<li>
New Devices— The number of new devices that were used to log in in the past 7 days, which users logged in with these devices, and the login time. 
</li>
<li>
New locations— A list of new locations the devices had logged in from in the past 7 days, which users logged in under these locations, and the login time.
</li>
<li>
Security events— The number and type of security events related to and done by your company users in the past 7 days. To see these events, click on the Audit Log in the bottom section of the dashboard. 
</li>
<li>
Force logouts— The number of times the Logout or Log out all buttons had been clicked from the Devices or Security Dashboard page, which devices were logged out as a result, and the time and date they were logged out. 
</li>
</ul>
<hr>
<h2>
<a name="security-assessment"></a>Security Assessment
</h2>
<div class="support-note success primary">Note: This is available on all Pipedrive plans. </div>
 This Security Assessment section will give you a report on what Pipedrive believes are potential security vulnerabilities in your Pipedrive company account, based on current access and permission-related user settings. 
The measures are categorized as High-Risk Issues, Low-risk Issues, or Non-Issues. If there are any High-Risk or Low-Risk issues, alerts and suggestions will be provided to help decrease the amount of security risk that is detected in your company account. To see the measures that Pipedrive uses to assess account security, you can click on See what you can improve. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_3.38.17_PM.png" alt="Screen_Shot_2019-06-04_at_3.38.17_PM.png" width="501" height="502" data-image="lwgbmq9lodm2"></figure>
 Clicking on Review Permissions will bring you directly to the company's permission settings so you can adjust your user permissions accordingly. Clicking on the question mark icon next to each measure will provide a tooltip from Pipedrive on how you can improve this particular security measure in your company settings.
<div class="support-note primary">
Note: Depending on the nature and setup of your business, the security alerts and tips suggested may not be of critical urgency to your company account. We recommend looking over the measures to see which ones may be the most relevant to you before making any permission or setting changes. 
</div>
<hr>
<h2>
<a name="active-devices"></a>Active Devices
</h2>
<div class="support-note success primary">Note: The Active Devices feature is one of the many useful features of Pipedrive's Enterprise plan. </div>
Under Active devices, you will be able to see all of the devices that are currently logged into your Pipedrive company account. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_1.53.37_PM.png" alt="Screen_Shot_2019-06-04_at_1.53.37_PM.png" width="600" height="218" data-image="b6zfn1ozn55c"></figure>
 The following fields are provided for each device entry:
<ul>
<li>
User— The user logged in with that device and the permission level they are on.
</li>
<li>
Device— The device used to log in.
</li>
<li>
Location— The location that the device logged in from and the IP address.
</li>
<li>
Login— The date and time of login and the method used to log in. (30d) means the user had clicked the “remember me” button when logging into Pipedrive and will stay logged in for 30 days. (12h) means the user had not clicked the “remember me” button when logging into Pipedrive and will be automatically logged out after 12 hours.
</li>
</ul>
 If you hover over the device entry, you will be able to manually log that device out by clicking the Log Out button that appears on the right side. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_2.31.06_PM.png" alt="Screen_Shot_2019-06-04_at_2.31.06_PM.png" width="592" height="51" data-image="utci4d50ssq2"></figure>
 
The filter button in the top right corner will give you the option to choose which user you wish to see. If you want to force log out all of the filtered devices or export this list to a spreadsheet, you can click on the … icon. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_3.00.53_PM.png" alt="Screen_Shot_2019-06-04_at_3.00.53_PM.png" width="200" height="193" data-image="22875a5pboxl"></figure>
<hr>
<h2>
<a name="device-history"></a>Device history
</h2>
<div class="support-note success primary">Note: The Device history feature is one of the many useful features of Pipedrive's Enterprise plan.</div>
Under Device history, you will be able to see a list of all of the devices that have been used to log into your Pipedrive Company account in the past two months. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_1.53.54_PM.png" alt="Screen_Shot_2019-06-04_at_1.53.54_PM.png" width="600" height="217" data-image="e8w15zoj6j23"></figure>
 The following fields are provided for each device entry:
<ul>
<li>
User— The user logged in with that device and the permission level they are on.
</li>
<li>
Device— The device used to log in.
</li>
<li>
Location— The location that the device logged in from and the IP address.
</li>
<li>
Login— The date and time of login and the method used to log in. 
</li>
<li>
Logout— The date and time of logout and the method used to log out. The method of logout can either be manually or through expiration. 
</li>
</ul>
The filter button in the top right corner will give you the options to choose which user and time frame you wish to see. The … button will also allow you to export your filtered results to a spreadsheet. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-06-04_at_3.04.34_PM.png" alt="Screen_Shot_2019-06-04_at_3.04.34_PM.png" width="300" height="187" data-image="8k9gy4mu5z4f"></figure>
<hr>
<h2>
<a name="audit-log"></a>Audit Log
</h2>
<div class="support-note success primary">Note: The Audit log feature is one of the many useful features of Pipedrive's Enterprise plan.</div>
Under the Audit log section, you will be provided with a log of all of the security-related changes made in your company account by any user in the past two months. Configured <a href="https://support.pipedrive.com/article/security-alerts" target="_blank">Security alerts</a> can be tracked under the Alerts tab. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-03_at_10.33.11_AM.png" alt="Screen_Shot_2020-04-03_at_10.33.11_AM.png" width="599" height="208" data-image="gqao3evl81dz"></figure>
 The following fields are provided for each security-related event:
<ul>
<li>
User— The user name and permission level they are on.
</li>
<li>
Event— The security-related event that occurred.</li>
<li>
Type— The type of security-related event that occurred.
</li>
<li>
Time— The date and time of the security-related event.
</li>
</ul>
 In the top right corner, you can filter for the user, type of security event, and time frame. The … button will also allow you to export your filtered results to a spreadsheet.
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2019-11-15_at_3.55.17_PM.png" alt="Screen_Shot_2019-11-15_at_3.55.17_PM.png" width="400" height="318" data-image="zjliqf3d26co"></figure>
 
<hr>
<h2>
<a name="security-dashboard-summary-emails"></a>Security Dashboard summary emails</h2>
At the beginning of each month, all admins and users with permission to see the Security Dashboard will get an email with a summary of security-related events that occurred in the previous month. 
This email will present the number of new devices, new locations, security events, forced logouts, as well as high and low-risk security vulnerabilities.
<figure><img src="https://kb-cms.pipedriveassets.com/Security_Dashboard_Monthly_Summary_email.png" alt="Security_Dashboard_Monthly_Summary_email.png" width="399" height="598" data-image="x8bu717wtj6t"></figure>
If there's anything worth further investigating, you can click on Security Dashboard to be brought directly to the security page in your Pipedrive account.

Security Dashboard

right-now

Right Now

last-7-days

Last 7 days

security-assessment

Security Assessment

active-devices

Active Devices

device-history

Device history

audit-log

Audit Log

security-dashboard-summary-emails

Security Dashboard summary emails

<div class="support-note primary">
Note: The Single sign-on feature is one of the many useful features of Pipedrive’s Essential, Advanced, Professional, and Enterprise plans.</div>
If you have a big Sales team, you know the administrative pain of creating multiple new accounts every time someone joins your team. To help you cut back on onboarding time and overheads, we have Single sign-on — or "SSO" — in the Essential, Advanced, Professional, and Enterprise plans of Pipedrive.
<figure><img class="vidyard-player-embed" src="https://play.vidyard.com/sKGzqHumSa3bGztFQZLS1K.jpg" data-uuid="sKGzqHumSa3bGztFQZLS1K" data-v="4" data-type="inline" data-image="51y3zvercfc9"></figure>
<div class="support-note primary">
If you are just getting started with Pipedrive, you can check out our Get your team on board <a href="https://www.pipedrive.com/en/academy/courses/get-your-team-on-board?ref=kb_article" target="_blank">Pipedrive Academy course</a>.</div>
<hr>
<h2><a name="setting-up-sso"></a>
Setting up SSO </h2>
An account with SSO enabled means you only have to create one set of logins for your users. You can set up an account for them in your own system and they'll automatically have login credentials for Pipedrive, saving your team time and effort.

<div class="support-note success primary">Note: Setting up SSO requires some technical expertise, so we suggest speaking to your internal IT teams for their assistance in providing the necessary information for the SAML configuration.</div>
To configure their SAML settings for Single sign-on, Admin Users can go to Settings &gt; <a href="/settings/sso">Single sign-on</a> in their company Pipedrive account. You'll need to enter some keys that your internal IT team should be able to locate for you, then you're away — it's really that simple! 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-08-25_at_4.38.37_PM.png" alt="Screen_Shot_2020-08-25_at_4.38.37_PM.png" width="825" height="533" data-image="ytx9lpp639kx"></figure>
 Once you have tested the provided information and confirmed that it works, simply click the Enable for users toggle. The information will need to be copied over to your SSO provider. We have more information on how to set up SSO for the most popular SSO providers here: 
<ul><li><a href="https://support.pipedrive.com/en/article/pipedrive-single-sign-on-azure-ad">Using SSO with Azure AD</a></li><li><a href="https://support.pipedrive.com/en/article/pipedrive-single-sign-on-okta">Using SSO with Okta</a></li></ul>
If you would like the added security of disabling password access to Pipedrive and relying on SSO alone, simply click the Enforce SSO login toggle.
<hr>
<h2><a name="granting-user-access"></a>Granting user access </h2>
You will first need to give the user access to Pipedrive in your SSO provider's (e.g Okta) settings. The user will then be able to log into Pipedrive using SSO. If the user already was active in Pipedrive with the same email, a regular user verification flow will be done. 
If the user does not have a Pipedrive account yet, an account will be created after the login attempt and a Pipedrive admin will need to activate that account under Pipedrive settings. 
Logging in and logging out
To log into Pipedrive with SSO, go to <a href="http://app.pipedrive.com/auth/sso" rel="nofollow">app.pipedrive.com/auth/sso</a>. Clicking logout from Pipedrive will only log you out from Pipedrive and not your SSO provider.
<hr>
<h2><a name="deactivating-a-user"></a>Deactivating a user </h2>
When deactivating a Pipedrive user through your own SSO system, we suggest keeping the following things in mind:
<ul>
<li>Deactivating a user disables their login credentials. You will continue to pay for the user and the seat, so if you don't intend to replace that user, make sure to remove the seat as well to avoid any unexpected surprises on your invoice.</li>
<li>While the user's login credentials will be disabled, they will still be able to access their account for up to thirty days if they remain logged in. To prevent any issues, we suggest ensuring that users log out of Pipedrive and are <a href="https://support.pipedrive.com/en/article/how-can-i-deactivate-or-reactivate-a-user#C1IamCs" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="115005422805">deactivated in Pipedrive</a> when you deactivate their login credentials through your own SSO system.</li>
</ul>
<div class="support-note success primary"> Note: The Single sign-on feature does not work alongside Pipedrive's <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000808405">Two-factor authentication</a> function.</div>

Single sign-on (SSO)

setting-up-sso

Setting up SSO

granting-user-access

Granting user access

deactivating-a-user

Deactivating a user

<div class="support-note success primary">Note: The Security Dashboard feature is one of the many useful features of Pipedrive's Enterprise plan.</div>
Pipedrive offers many easy-to-use security-related features to give you full transparency of when and how your data is being accessed. 
If you already have the <a href="https://support.pipedrive.com/en/article/single-sign-on" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000169049">single sign-on</a> feature enforced in your company account, you will not see the <a href="https://support.pipedrive.com/en/article/security-rules#C1IamCs" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360004510857">2FA</a>, <a href="https://support.pipedrive.com/en/article/security-rules#C2IamCs" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360004510857">Password strength</a>, and <a href="https://support.pipedrive.com/en/article/security-rules#C3IamCs" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360004510857">Password expiration and reuse</a> options under the <a href="https://support.pipedrive.com/en/article/security-rules" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360004510857">Security Rules</a> feature. They are hidden under Security Rules because SSO is a more secure way of protecting data, and therefore overrides these options. 
The Advanced rules section will always be available under Security Rules regardless of whether SSO is enforced or not. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-01-20_at_2.53.26_PM.png" alt="Screen_Shot_2020-01-20_at_2.53.26_PM.png" width="601" height="394" data-image="e02w5te5wfnz"></figure>
If single sign-on is enabled in your account but not enforced, the 2FA, Password strength, and Password expiration and reuse sections will be available to be set up by an Admin user under Security Rules.

Using SSO (single sign-on) with Security Rules

<div class="support-note primary">
Note: The Security alerts feature is one of the many useful features of Pipedrive's Enterprise plans. Only Admin users can set up Security alerts in a company account. 
</div>
 The Security Alerts feature will allow admins users to set up email notifications according to security-related events that occur in the company account. With these alerts enabled, admins will be notified immediately or regularly to assess when company data may be at risk.
To access and set up Security alerts, go to Settings &gt; Security Center &gt; <a href="/settings/security-alerts">Alerts</a>.

<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-08-25_at_4.36.31_PM.png" alt="Screen_Shot_2020-08-25_at_4.36.31_PM.png" width="963" height="655" data-image="27f5cq4ijtu9"></figure>
<hr>
<h2>
<a name="account-access-alerts"></a>Account access alerts</h2>
<div class="support-note success primary">Note: Security email alerts will be sent to the email address of the admin user's login email address.</div>
The Account access alerts section will allow you to receive email alerts when a user access related event happens in your account. These alerts will be triggered by activity from both regular users and other admin users. 
You can set up email alerts for any time one of the following user access related events occurs: 
<ul>
<li>User logs in from a new device</li>
<li>User logs in from a new location </li>
<li>New user is invited</li>
<li>User has more than 3 failed login attempts in a row </li>
<li>User requests password reset </li>
</ul>
 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_2.40.44_PM.png" alt="Screen_Shot_2020-04-01_at_2.40.44_PM.png" width="599" height="275" data-image="leza2abhl0in"></figure>
Once you've selected the alerts you want to receive, you can set up the grouping and time of your alerts. 
<ul>
<li>Each alert as a separate email, sent instantly</li>
<li>
All in one email, sent at a specific time— If you select this option, you will see the option to choose the day and time you wish to receive the email. </li>
</ul>
<hr>
<h2>
<a name="data-leakage-and-loss"></a>Data leakage and loss </h2>
Alerts related to <a href="https://support.pipedrive.com/en/article/exporting-data-from-pipedrive" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="115000797525">exporting</a> or deleting data are configured separately under Data leakage and loss. These alerts are triggered when another admin or regular user downloads an exported file or deletes data in Pipedrive. 
You can set up email alerts for when the following occurs:
<ul>
<li>User downloads exported deals, organizations, people, activities, or notes. </li>
<li>User deletes pipelines or stages</li>
<li>User deletes custom fields </li>
</ul>
 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_5.37.45_PM.png" alt="Screen_Shot_2020-04-01_at_5.37.45_PM.png" width="601" height="145" data-image="nlt88zo07v4t"></figure>
 For deals, people, and organization deletions, you can configure the amounts of deletions so that the email alert only gets triggered once one user deletes a certain amount of that particular item. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_3.04.01_PM.png" alt="Screen_Shot_2020-04-01_at_3.04.01_PM.png" width="602" height="123" data-image="ce2lz7rsu8ig"></figure>
While each admin user can configure the alerts they individually want to receive, the amounts applied to the deal, people, and organization deletion triggers will be applied company-wide and be overridden if another admin user resets the number. 
<ul>
<li>
Admin 1: Sets the deal deletion alert threshold to 20 deals deleted and saves. </li>
<li>
Admin 2: Sets the deal deletion alert threshold to 10 deals deleted and saves. </li>
<li>The number of deal deletions needed to trigger the alert set by Admin 1 will now be overridden and reset to 10 for all admins who have that alert enabled. </li>
</ul>
 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_5.45.23_PM.png" alt="Screen_Shot_2020-04-01_at_5.45.23_PM.png" data-image="oijagsctfvpj"></figure>
 The grouping and timing of the data leakage and loss alerts are configured separately from the account access alerts. You can choose for the alerts to send as separate emails, sent instantly, or all in one email, sent at a specific time. 
<figure><img src="https://kb-cms.pipedriveassets.com/previewandenforce.png" alt="previewandenforce.png" width="600" height="176" data-image="fr38ru67mudn"></figure>
<hr>
<h2>
<a name="preview-and-save-changes"></a>Preview and save changes </h2>
Once you've configured your alerts, you can click on Preview and save to see an overview of your alert settings before saving. These alerts will only apply to the admin setting them up. 
<h2><figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-01_at_6.18.21_PM.png" alt="Screen_Shot_2020-04-01_at_6.18.21_PM.png" width="601" height="384" data-image="hwy453hj7ei3"></figure></h2>
The email alerts configured to send out instantly:
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_3.13.08_PM.png" alt="Screen_Shot_2020-04-02_at_3.13.08_PM.png" width="499" height="510" data-image="0l3skjgyyzc6"></figure>
Email alerts configured to be sent at a specific time daily or weekly:
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_3.04.35_PM.png" alt="Screen_Shot_2020-04-02_at_3.04.35_PM.png" width="500" height="559" data-image="thh5m417mdzq"></figure>
<hr>
<h2>
<a name="viewing-alerts-in-the-security-dashboard-audit-log"></a>Viewing alerts in the Security Dashboard audit log</h2>
All security alerts can be tracked by going to Security Dashboard &gt; Audit log &gt; <a href="/settings/security-dashboard/audit-log">Alerts</a>. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_4.19.49_PM.png" alt="Screen_Shot_2020-04-02_at_4.19.49_PM.png" width="601" height="383" data-image="9x4fxicdtru0"></figure>
 
For the deleted deal, people, and organization alerts and failed login attempts, you can click on the event to see a full list of the items deleted.
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-04-02_at_5.49.50_PM.png" alt="Screen_Shot_2020-04-02_at_5.49.50_PM.png" width="700" height="235" data-image="4ua0eaciamaw"></figure>

Security Alerts

account-access-alerts

Account access alerts

data-leakage-and-loss

Data leakage and loss

preview-and-save-changes

Preview and save changes

viewing-alerts-in-the-security-dashboard-audit-log

Viewing alerts in the Security Dashboard audit log

<div class="support-note success primary">Note: This integration can only be configured by the admin user in both Okta and your Pipedrive account.</div>
Pipedrive's <a href="https://support.pipedrive.com/en/article/single-sign-on">Single Sign-on (SSO)</a> feature integrates with Okta to ensure that your team can access Pipedrive easily using your identity provider.
<hr>
<be></be>
<h2><a name="install-the-app"></a>Install the app</h2>
To begin, install the Pipedrive app from your Okta Administrator Dashboard. An admin user can select Applications, search for Pipedrive and click Add. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen%20Capture%20on%202021-03-24%20at%2009-51-37.gif" data-image="13185" alt="Okta start"></figure>
Enter the subdomain of your Pipedrive account into the corresponding field before clicking Next to confirm. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-24%20at%2010.00.10.png" data-image="13186" alt="Okta Subdomain"></figure>
 
<hr>
<h2><a name="configuring-sso"></a>Configuring SSO</h2>
Make sure to assign your users to Pipedrive from Okta before testing the SSO. Under Applications, click the gear symbol, and Assign to Users.
<figure><img src="https://kb-cms.pipedriveassets.com/Assign%20to%20users.png" data-image="13192" alt="Assign to users"></figure>
To start configuring SSO, select SAML 2.0 under Sign On Methods, and click View Setup Instructions.
<figure><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-24%20at%2010.06.17.png" data-image="13189" alt="SAML 2.0"></figure>
On the <a href="https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Pipedrive.html?base[…]admin.okta.com&amp;app=pipedrive&amp;instanceId=0oacvzounNX8DAL7b5d6">Setup Instructions </a><a href="https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Pipedrive.html?base[…]admin.okta.com&amp;app=pipedrive&amp;instanceId=0oacvzounNX8DAL7b5d6">page</a>, you will find values for Issuer, Single Sign-On (SSO) URL, and X.509 certificate that you need to enter in your Pipedrive <a href="http://app.pipedrive.com/settings/sso">SSO settings page.</a> Your Pipedrive SSO settings page can be found by going to Settings &gt; Security Center &gt; <a href="https://app.pipedrive.com/settings/sso">Single sign-on</a>.
You can copy and paste all of these fields directly to their corresponding fields in Pipedrive. 
<figure style="max-width: 570px;"><img src="https://kb-cms.pipedriveassets.com/Markup%202021-03-24%20at%2010.42.34.png" data-image="13195" alt="Okta SSO blur" width="570" height="632"></figure>
<figure style="max-width: 571px;"><img src="https://kb-cms.pipedriveassets.com/Markup%202021-03-24%20at%2010.39.24%20(1).png" data-image="13199" alt="SSo PD" width="571" height="485"></figure>
<hr>
<h2><a name="testing-the-sso-setup"></a>Testing the SSO Setup</h2>
Once you have copied and pasted the values, click Save and Test. If everything has been configured correctly, you should see a success message.
<figure style="max-width: 596px;"><img src="https://kb-cms.pipedriveassets.com/Screenshot%202021-03-24%20at%2010.52.45.png" data-image="13204" alt="SSO success" width="596" height="65"></figure>
You can then enable SSO for your users by clicking the toggle at the bottom of the page.
<figure><img src="https://kb-cms.pipedriveassets.com/Enable%20for%20users.png" data-image="13201" alt="Enable for users"></figure>

Using Pipedrive Single sign-on (SSO) with Okta

install-the-app

Install the app

Testing the SSO Setup

Pipedrive offers numerous security-related features to give you full transparency of how and when your data is being accessed. 
<div class="support-sections">
Sections
<a href="#C1IamCs">1: Permission and Visibility settings</a>
<a href="#C2IamCs">2: 2FA: Two-factor authentication</a>
<a href="#C3IamCs">3: Single sign-on (SSO)</a>
<a href="#C4IamCs">4: Security Dashboard </a>
<a href="#C5IamCs">5: Security Rules </a>
<a href="#C6IamCs">6: Security Alerts </a>
</div>
<hr>
<h2>
<a name="C1IamCs"></a>Permission and Visibility settings</h2>
Permission Sets Admin users can set up <a href="https://support.pipedrive.com/en/article/permission-sets" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000309478"> Permission Sets</a> to control what other users can do in Pipedrive, such as deleting deals or editing custom fields. You can see the full list of actions that can be controlled via Permission sets in <a href="https://support.pipedrive.com/en/article/permission-sets" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000309478">this article.</a> The number of permission sets you have depends on the plan you are on. 
<ul>
<li>
Essential and Advanced plans Two permission sets: 'regular users' and 'admin users'.</li>
<li>
Professional plan Regular and admin users sets, plus one additional customizable permission set called 'managers'.</li>
<li>
Enterprise plan The above three groups, plus the ability to create additional custom permission sets. </li>
</ul>
 Visibility Groups While Permission sets control what users can do in Pipedrive, <a href="https://support.pipedrive.com/en/article/visibility-groups" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000309498"> Visibility groups</a> control what deals, contacts, and products users can see. Creating visibility groups is useful if you want certain users to not see specific information in your company account. The number of visibility groups you have also depends on the plan you are on. 
<ul>
<li>
Essential and Advanced plans Two visibility groups: the item's owners &amp; followers, or to the entire company. </li>
<li>
Professional or Enterprise plans Four visibility groups: item's owner only, owner's visibility group, owner's visibility group and sub-groups, or to the entire company. </li>
</ul>
<hr>
<h2>
<a name="C2IamCs"></a>2FA: Two-factor authentication </h2>
The <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000808405"> 2FA feature </a>adds an extra layer of security to confirm that the user trying to log into Pipedrive is actually who they say they are. 
When 2FA is enabled, logging into Pipedrive will prompt an email to be sent to the email address you use to log into Pipedrive. This email will contain information about the login attempt as well as a verification link that will allow you access to your Pipedrive account. 
<hr>
<h2>
<a name="C3IamCs"></a>Single sign-on (SSO)</h2>
Many large companies use a third-party SSO service such as Okta and Azure AD to allow users to securely authenticate and log into multiple applications with just one set of login credentials. 
Pipedrive's <a href="https://support.pipedrive.com/en/article/single-sign-on" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000169049">Single sign-on feature</a> will allow you to add Pipedrive to the SSO provider your company has set up, allowing for a stress-free Pipedrive login experience for users and a more secure way of for administrators to control user access. 
<hr>
<h2>
<a name="C4IamCs"></a>Security Dashboard</h2><div class="support-note success primary">Note: The Security Dashboard feature is available for our Enterprise plan users.</div>
The <a href="https://support.pipedrive.com/en/article/security-dashboard" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360001757818">Security Dashboard feature</a> will provide full transparency of user access information and security-related activity that occurs in your company account. The following features are available on our enterprise plan.
<ul>
<li>
User access and device logs Which users are accessing your account and any additional login information such as device, location, and login time.</li>
<li>
Audit log A log of all of the security-related changes made in your company account by any user in the past two months. 
</li>
<li>
Security Assessment A report on what Pipedrive believes are potential security vulnerabilities in your Pipedrive company account, based on current access and permission-related user settings.
</li>
</ul>
On Pipedrive's essential and advanced plans, you will not have access to all of these features, but you will have a security dashboard displaying:
<ul><li>Users logged in.</li><li>A brief overview of the past week.</li><li>A security assessment showing you high and low-risk issues.</li></ul>
<h2> </h2>
<hr>
<h2>
<a name="C5IamCs"></a>Security Rules</h2><div class="support-note success primary">Note: The Security Rules feature is available for our Enterprise plan users.</div>
With the <a href="https://support.pipedrive.com/en/article/security-rules" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360004510857">Security Rules</a> feature, admin users of a Pipedrive company account can enforce access restrictions to ensure that business data is only available to the right people at the right place and time.
<ul>
<li>2FA: Two-factor authentication Enforce 2FA for all users.</li>
<li>Password rules Enforce password related rules such as password strength, password expiration, and password reuse.</li>
<li>
IP address and time range access The advanced rules section of the Security Rules feature will allow you to limit user access by IP address and time range. 
</li>
</ul>
<hr>
<h2>
<a name="C6IamCs"></a>Security Alerts </h2><div class="support-note success primary">Note: This Security Alerts feature is available for our Enterprise plan users.</div>
The <a href="https://support.pipedrive.com/en/article/security-alerts" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360007063858">Security Alerts feature</a> will allow admins users to set up email notifications according to security-related events that occur in the company account. The alerts can be configured to send out in live time or in regular daily or weekly intervals. 
<ul>
<li>
Account access alerts Email alert sent when any user access related activity occurs, such as user logs in from a new device, user logs in from new location, etc. </li>
<li>
Data leakage and loss Email alert sent when data is exported or deleted from Pipedrive. </li>
<li>
Audit log All security alerts can be tracked in the <a href="https://support.pipedrive.com/en/article/security-dashboard" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360001757818">Security Dashboard</a> under the audit log. </li>
</ul>

Security Features in Pipedrive

The added layer of security provided by <a href="https://support.pipedrive.com/en/article/2fa-two-factor-authentication" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000808405">two-factor authentication</a> (2FA) also restricts the ability to effectively sync with some providers when using the Email Sync feature. If you wish to sync your Outlook account to Pipedrive while still enabling two-factor authentication (2FA), Outlook recommends that you follow <a href="https://docs.microsoft.com/en-us/azure/active-directory/user-help/multi-factor-authentication-end-user-app-passwords" target="_blank">these steps</a>.

How can I sync Outlook when I have 2FA enabled?

Your Pipedrive account is filled with all of the valuable information that makes your business operate effectively, so you always want to protect it. To protect your Pipedrive user account, we suggest enabling the two-factor authentication login verification function within Pipedrive. To access two-factor authentication, go to Settings &gt; Password and login &gt; <a href="/settings/password">Two-factor authentication (2FA)</a>, and enable the function for your user account in Pipedrive. <figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-08-25_at_4.43.39_PM.png" alt="Screen_Shot_2020-08-25_at_4.43.39_PM.png" width="975" height="617" data-image="xaeswmfsd0ch"></figure>
 When enabled, logging into Pipedrive will prompt an email to be sent to the email address you use to log into Pipedrive, with a verification link that will allow you access to your Pipedrive account. That same email will provide you with information about where that verifiable login occurred in the world. If you find that the information presented there does not match your login attempt, we suggest <a href="https://support.pipedrive.com/en/article/how-can-i-change-or-reset-my-password" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="115005849529">changing your login credentials</a>, as someone may be attempting to gain access to your account. <div class="support-note success primary">Note: Due to differing protocols, Pipedrive's two-factor authentication cannot work alongside the 'Log in with Google' function or the <a href="https://support.pipedrive.com/en/article/single-sign-on" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360000169049">Single-sign-on feature</a> of the Advanced, Professional, and Enterprise plans. We suggest your company choose the option that best fits its security needs.</div>

2FA: Two-factor authentication

Security Features

<div class="support-note primary">
Note: Each user can have up to three devices logged into the same user account. </div>
 In this internet-connected age, there are many ways to access your precious Pipedrive data. To make sure that your account is only being accessed by devices that you know, you should regularly monitor the Actives devices used to access your Pipedrive user account. To access this information, go to Settings &gt; Your devices &gt; <a href="https://app.pipedrive.com/settings/devices">Active devices</a> in your Pipedrive account. 
<figure><img src="https://kb-cms.pipedriveassets.com/actual.png" alt="actual.png" width="600" height="308" data-image="j7lagr2ketic"></figure>
This page will display the information pertaining to devices that currently have access to your Pipedrive user account, including any mobile devices accessing the account through a web browser or the Pipedrive mobile app. When clicking on one of the devices, you will be able to see the IP address used when accessing the account, the method used to log in, and if the 'Remember login' option was enabled when logging in. If you wish to log out any of those active devices, you may do so by clicking the Log out button next to that specific device's name. Doing so will log that device out of Pipedrive, and they will be prompted to provide valid login credentials again in order to continue accessing the account. If you would like to see information regarding the previous login sessions for your Pipedrive user account, you may find that under the Device history section of this same page. To learn more about device history, click <a href="https://support.pipedrive.com/en/article/how-can-i-see-which-devices-i-have-used-to-access-pipedrive" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360001086418">here</a>. If you feel that any of your active devices or device history is by an unauthorized device, you may wish to change your Pipedrive password to secure your account. To learn more about changing your password, click <a href="https://support.pipedrive.com/en/article/how-can-i-change-or-reset-my-password" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="115005849529">here</a>.

How can I log myself out of Pipedrive on my connected devices?

If you enter the wrong password three times in a row while logging into your Pipedrive account, you will be locked out of your account. This is to ensure that your login process is protected against external threats. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-10-05_at_3.01.06_PM.png" alt="Screen_Shot_2020-10-05_at_3.01.06_PM.png" width="502" height="381" data-image="d5f3jjz1o2nw"></figure>
When you are locked out, you will be automatically sent an email to unlock your account. Once you unlock your account through the email, you can log into your account using your email and password again. If you don't remember your password, we recommend <a href="/auth/login/forgot_password?from=account_locked">resetting your password</a>. 
<div class="support-note primary">
Note: If you are not able to access your email, you will be locked out of your account for 24 hours. Once the 24 hours are over, you can try to log into your account again. </div>
<figure><img src="https://kb-cms.pipedriveassets.com/Screen_Shot_2020-10-05_at_3.05.36_PM.png" alt="Screen_Shot_2020-10-05_at_3.05.36_PM.png" width="599" height="687" data-image="gws189vuhfdc"></figure>
<div class="support-note primary">
Note: If you received this email without attempting to log into your Pipedrive account, you should <a href="https://support.pipedrive.com/en/article/contacting-pipedrive-support" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="115005875565">reach out to our team</a> right away. </div>
<hr>
Security Dashboard
If you are on the Professional or Enterprise plans, you will be able to see login attempts in the Security Dashboard. To see when users have failed to login three times in a row, go to your Audit log tab. 
<figure><img src="https://kb-cms.pipedriveassets.com/Screenshot_2020-10-06_at_13.16.16.png" alt="Screenshot_2020-10-06_at_13.16.16.png" width="695" height="404" data-image="2emqc0pfl9fu"></figure>

Security: Locked out of account after failed login attempts

<div class="support-note primary">
Note: Each user can have up to three devices logged into the same user account. </div>
When you have a database of valuable information in Pipedrive, you'll want to make sure that it stays secure. To make sure that your account is only being accessed by devices that you know, you should regularly monitor the Device history of your Pipedrive user account. To access this information, go to Settings &gt; Your devices &gt; <a href="/settings/personal/devices">Device history</a> in your Pipedrive account. <figure><img src="https://kb-cms.pipedriveassets.com/device_history_correct.png" alt="device_history_correct.png" width="601" height="312" data-image="5a05onho3rts"></figure>
 In this area, you will see a list of the devices used to access your Pipedrive user account. You'll be able to see exactly what kind of device was used to access Pipedrive, and the location and IP address used when accessing the account. You'll also be able to see when and how the login occurred, and when and how that login session was completed. If needed, this information can be exported into a spreadsheet — either in .xlsx or .csv format —for your convenience. If you feel that your Pipedrive user account is being accessed by unauthorized devices, you may wish to forcibly log those devices out. To learn more about logging out those devices, click <a href="https://support.pipedrive.com/en/article/how-can-i-log-myself-out-of-pipedrive-on-my-connected-devices" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="360001078097">here</a>. Once logged out, you may wish to change your Pipedrive password to secure your account. To learn more about changing your password, click <a href="https://support.pipedrive.com/en/article/how-can-i-change-or-reset-my-password" target="_blank" data-type="zendeskArticle" data-language="en" data-zendesk-id="115005849529">here</a>.

How can I see which devices I have used to access Pipedrive?

Account Access

Privacy and Security

Knowledge Base

Privacy and Security

Data Security in Pipedrive

Security Features

Account Access

Got any questions?