This feature allows access only from specific IP addresses (or IP address ranges) and denies all other access. By allowing access only through set routes, such as your internal network, offices, or VPN connections, you can greatly strengthen security.

In Dive, you can register restrictions using global IP addresses (IPv4 / IPv6) in three formats: single address, range, and CIDR. Once the settings are saved, logins from IP addresses that are not on the allowed list are blocked, even for users with owner permissions. On the Enterprise plan, you can choose how access from networks outside the allowed list is handled, such as "Only material upload is available" or "Available if multi-factor authentication (MFA) has been passed" (see "Set up access from outside the allowed networks" below).

Who can set this up

Only users with owner permissions can set this up.

Check these before you start

This feature is a strong restriction. A wrong setting can lock everyone out, including the owner, so be sure to check the following.

• Confirm that the IP addresses you set are global IPs (outward-facing IPs assigned by your internet provider or VPN)
• Before you set this up, be sure to include your own global IP
• We recommend that you keep a copy of your allowed IP addresses by using Export to Excel so you can check them right after setup

※ If you ever cannot log in, please contact us at customer-success@episotech.com.

Setup steps

1. Log in to Dive and click [Owner Functions]
   
2. Select the [Security] tab at the top, and open the [IP Address Restriction Settings] card

3. Check "Use IP address restriction"

   

4. Open the allowed list field, and click one of the following depending on the format you want to register
   • [+ Add]: Register a single IP address or a CIDR format (example: 192.168.0.0/24)
   • [+ Add by range]: Register a range from a start IP address to an end IP address

5. Enter the IP address you want to allow (three formats are supported)

   • Single IP: 203.0.113.5 / 2001:db8::1
   • Range: 203.0.113.5 to 203.0.113.50
   • CIDR: 192.168.0.0/24 / 2001:db8::/32

   While you type, an invalid format is shown right away with a red error message
   

6. When you are done, click [Save]
   

Safety check when saving

When you save, if the network used by your current session (the IP address you are accessing from now) is not on the allowed list, the following message appears. It is added automatically, so click [OK]. This prevents you from being locked out right after setup.

Note: If the "People who passed multi-factor authentication" row (described below) is set to [All features] and you are included in that group, this message does not appear. This is because you can reconnect with multi-factor authentication and change the settings. If the row is set to [Material upload only], you cannot open the settings screen even after reconnecting, so the message appears as before.

Set up access from outside the allowed networks

You can decide how access from networks that are not on the allowed list is handled for each user group, such as when traveling or using a mobile connection. By default, both groups are set to "Not available," and nothing changes until you change this setting.

Changing this setting does not change the list of allowed IP addresses. Use from allowed networks stays the same as before. Only the handling of other networks changes.

Decide with two rows

The setting has two rows: "who" and "how far they can use it." For each row, choose a level from the dropdown.

• People who passed multi-factor authentication ... [Not available] / [Material upload only] / [All features]
• Everyone else ... [Not available] / [Material upload only]

If you select anything other than [Not available], a field for specifying target users appears under that row. Choose [Everyone] or [Only the specified users]. If you choose [Only the specified users] without specifying any users, nobody can use that row (a warning also appears on the settings screen).

The two rows are independent. For example, to let administrators use all features from outside the office while field staff can only upload materials from outside, set the first row to [All features] and the second row to [Material upload only]. Conversely, to never show procedures outside the office but let in people who passed multi-factor authentication, set the first row to [Material upload only] and the second row to [Not available].

The settings screen always shows how your current choices will branch. Before you save, check that the combination matches what you intended.

Available plan

This setting is available on the Enterprise plan. Only users with owner permissions can change it.

Setup steps

1. Open [Owner Functions], then open the [IP Address Restriction Settings] card from the [Security] tab at the top
2. Check that "Use IP address restriction" is turned on (if IP address restriction is off, this setting has no effect)
3. In each row under [Access from outside the allowed networks], choose the scope to allow. If you choose [All features], a confirmation message appears, so check the contents and click [OK]
4. For each row, choose [Everyone] or [Only the specified users]. If you choose [Only the specified users], select the target users
5. Check the branching shown under [How this setting behaves]
6. Click [Save]

If you uncheck "Use IP address restriction," this setting is also turned off at the same time. This prevents access from outside the allowed networks from opening unintentionally when you turn IP address restriction back on.

What you can do with "Material upload only"

When a user allowed in this scope connects from outside the allowed networks, only one screen for uploading materials is shown. Screens where content can be read, such as procedures, the material list, the admin screens, and reports, are not shown.

●What you can do

• Upload videos, photos, and other files (including running AI analysis during upload)
• Choose the "Who can see it" setting for uploaded materials (Only me / Group Shared / Team sharing)
• View the progress of files being uploaded
• Switch the display language, and Log out

●What you cannot do

• View, search, edit, or publish procedures (including shared URLs and offline playback saved on the device)
• View the material list, or play or download materials that have already been uploaded
• View AI analysis results (results for materials you uploaded yourself are not shown either)
• Use the admin screens, Usage Report, Skill Map, courses, and other features
• Open your own account settings (changing your password, registering multi-factor authentication, profile)

After uploading, check your materials in the material list once you are connected to an allowed network. If you set who can see them to [Only me], no one else can view those materials until you open them from an allowed network.

Note that screens you must respond to before you can continue, such as changing your password on first login or registering multi-factor authentication when it becomes required, are still shown in this state.

Login methods that apply

The two rows have different login methods that can be included.

• "People who passed multi-factor authentication" row: Only people who log in with email address and password and have set up multi-factor authentication are included. Single sign-on (Microsoft Entra ID / SAML) cannot be included in this row, because identity verification at login is done by the IdP, so Dive cannot confirm whether multi-factor authentication passed. Email-free accounts (people who log in with an ID issued by an administrator) and QR Code login on smart glasses also cannot be included in this row, because they are meant for shared devices
• "Everyone else" row: Because multi-factor authentication is not required, all of the login methods above can be included. For example, a setup where field staff upload videos recorded on a mobile connection is configured in this row

User permissions that apply

In rows where you choose [Material upload only], the user permissions that can upload materials (Owner, Team Administrator, Group Administrator, and Created user) are the ones included. View-only users and guests still cannot use Dive from outside the allowed networks, as before.

Preparation on the user side

Users targeted in the "People who passed multi-factor authentication" row must register for multi-factor authentication in advance. Please register while connected to an allowed network. For the steps, see Two-step verification (set up individually).

If you run this across the whole team, please also consider Requiring two-step verification (MFA) for all team members. Even if it is not required, you can use this setting. Users who have not registered for multi-factor authentication are simply not included in that row.

The "Everyone else" row does not require any preparation on the user side.

Messages shown when you cannot log in

• "IP address restriction: Not available from the network you are connected to": Both rows are set to [Not available]. Please connect from an allowed network
• "To use Dive from outside the allowed networks, multi-factor authentication must be set up. Please connect to an allowed network and set it up": You are a target user in the "People who passed multi-factor authentication" row, but you have not registered for multi-factor authentication yet
• "Use from outside the allowed networks is not permitted. Please check with your administrator": You are not included as a target user in either row. Please ask the owner to add you
• "Outside the allowed networks, only material upload is available. Your account cannot upload": Your user permission does not allow uploading materials (View-only user or guest)
• "This login method cannot be used from outside the allowed networks": This login method cannot be included in the "People who passed multi-factor authentication" row (such as single sign-on or email-free accounts). If you want to allow these users as well, set the "Everyone else" row to [Material upload only]

The network is also checked after you log in

The source IP address is checked again not only when you log in, but also after you have logged in, at these times:

• Every 5 minutes while a screen is displayed
• When you return to the screen or app, or when the network reconnects
• When an administrator turns on IP address restriction or changes the allowed list
• Before opening a procedure from a link or QR code received in the Dive app

If the connection is from a network that is not allowed, the system checks again after 10 seconds, and if it is still not allowed, you are logged out. The login screen shows "IP address restriction: You were logged out because the connection came from outside the allowed networks." If the check cannot be made, such as when communication is unavailable, you will not be logged out. This does not apply to people who logged in with permission from multi-factor authentication or the exception for the upload screen.

If a device leaves the office Wi-Fi and switches to a mobile connection, it will be logged out unless it returns within 10 seconds. If you have devices that use mobile connections in the field, please check the allowed list or the exception setting described above.

Checking the records

Changes to the settings, records of logins from outside the allowed networks that were allowed or denied by this setting, and records of logouts from the recheck after login are kept in the audit log. You can check who used Dive, when, and from which IP address (Export the audit log as CSV).

Excel import / Export to Excel

You can also manage the list of allowed IPs in bulk with Excel. Even organizations that manage many sites and VPNs can register a list prepared in Excel as is.

• [Export to Excel]: Download the current allowed list as an Excel file
• [Excel import]: Import the allowed list from an Excel file (.xlsx)

This is also useful when you change operating rules or want to keep a record for audits.

Tips for using it well

• Always test before applying to production: Save a minimal configuration that includes your own global IP, and check all the way through logging out and logging back in
• Require VPN access: Useful if you want to stop direct access from home or cafés and always require logging in through the VPN
• When adding a site: When you open a new site, always add that site's global IP before starting operations
• Mixed IPv4 and IPv6 environments: Depending on the provider, IPv4 and IPv6 may be mixed. Including both in the allowed list is safer

When using AI connections (Claude, ChatGPT, etc.)

In teams that use IP address restriction, AI connections (the feature that lets AI such as Claude or ChatGPT search for and read Dive procedures) cannot be used by default. This is because connections from AI come from the AI company's servers.

On the Enterprise plan, the owner can check [Allow AI connections even when IP address restriction is used] on the [AI connections (MCP)] card in the [Integrations] tab of [Owner Functions], then save. After that, the following AIs can be used. This row appears only for teams that use IP address restriction.

• AIs registered by your company (Microsoft Copilot, Google Gemini Enterprise)
• Claude (connections from the source addresses published by Anthropic)

ChatGPT cannot be used, because its list of connection sources may change. This setting is only for AI connections and does not affect your regular login (it is also not added to the allowed list). To grant permission when connecting AI (the "Connection to Dive" screen), do it from a place where you can use Dive under IP address restriction. For details, see Search and read procedures from AI such as Claude or ChatGPT (AI connections, beta).

When reading procedures through the API from your internal systems

On the Enterprise plan, you can search for and read Dive procedures from your internal systems using a key (API key) issued by the owner. In teams that use IP address restriction, you need to register the source IP address of the key (the address at the internet exit of the server that calls the API). A key without a registered address cannot be used. If you start using IP address restriction later, that key also cannot be used until you register its IP address.

Register the IP address for each key on the [API (search and read SOPs)] card in the [Integrations] tab of [Owner Functions]. It is not added to the team's allowed list, and it does not affect regular logins. For details, see Search and read procedures from internal systems and AI (API, beta).

Related

• Overview of security settings (Owner Functions)
• About the allowlist for security (external connection domains)
• Two-step verification (set up individually)
• Requiring two-step verification (MFA) for all team members
• Export the audit log as CSV