In Dive, you can use the owner-only Security Settings to finely control access restrictions, login authentication, data sharing restrictions, permissions per feature, device cache, audit logs, and more, to match your operating policy. This article gives an overview of all of them.

Who can change the settings

Only users with owner permissions can change the Security Settings.

How to open the settings screen

Log in to Dive with owner permissions
Open [Owner Functions] from the side menu
Select [Security] from the top tabs

Overview of all settings

Access restriction

Set up IP address restriction — Allows access only from specific sites or through a VPN (supports IPv4/IPv6, single addresses, ranges, and CIDR)

Login authentication

Set up password policy — Password expiration and forced password change at first login
Make two-step verification (MFA) mandatory for all team members — Requires TOTP for all team members (Enterprise plan only)
Set up Single Sign-On (SSO) — Microsoft Entra ID (OIDC) / SAML 2.0 integration, and prohibiting logins other than SSO (Enterprise plan only)
Automatically sync the roster from your HR system (SCIM) — Creates, updates, and disables accounts from your HR system or IdP as people join, transfer, or leave (Enterprise plan only)
Prohibit the use of email-free accounts — Prohibits issuing new ID-login accounts
Set up automatic logout (Session) — Time until logout with no activity (30 minutes to 24 hours / no limit) and Maximum time from login to logout (24 hours to 90 days / no limit). You can also choose not to count time spent with the SOP player displayed, during a remote support call, or while uploading materials as inactivity (by default, that time is also counted as inactivity). You can also choose whether this applies to the Dive app on smartphones and smart glasses (by default, browser only). You can also specify groups and users to exclude from automatic logout
Logged-in devices — Check the devices members are logged in on, and force logout when a device is lost or a member leaves

Data / sharing restrictions

External sharing restriction (enable/disable external sharing) — Whether to allow the time-limited external sharing URL feature for the team

Permissions per feature

Permitted user roles per feature — Role thresholds for SOP file export / Download of file-based SOPs / Export to Excel of the SOP list / External sharing / Media download / Download attachments / Development, Qualifications and Training export / Usage report export / Viewing records and checksheet export / Work analysis export / Creation Plan export (Enterprise plan only)

Device-side controls

Device cache settings (do not keep viewing data on the device) — Turns off offline playback and preloading and always requires a network connection (Enterprise plan only)

Logs

Export the audit log as CSV — Download the operation logs for the entire team as CSV

Related (settings on the [Business Rules] tab)

The following settings are on the [Business Rules] tab under [Owner Functions]. They are separate from Security Settings because they are rules for how work is done.

Approval settings — Whether the person who drafted an item can also be an approver, whether to allow publishing without approval, and so on (the approval flow itself is set up in User management)
Dictionary / glossary operation permissions — User roles that can propose, approve, and directly edit the Pronunciation Dictionary and Terminology Glossary
Allow viewing folders of subordinate groups (Folder view scope) — Whether users in the selected roles (Group Administrator and above, Created user and above, or View-only user and above) can also view folders for the groups under them (set View, Target roles, and the permission to edit and revise. By default, both View and edit are disabled)
Personalized AI Search guidance · Unresolved question list — Whether AI Search uses each person's course, skill, and work-performance records and HR fields, whether to collect unanswered questions, and which roles can view that list (all are on by default; roles that can view the list are Group Administrator and above)
Grow it from the records on site — Whether to collect records such as words corrected in SOPs to grow the Terminology Glossary (Core plan and above), and whether to automatically add aliases and explanations backed by sufficient evidence (both are on by default. On the Enterprise plan, learning also covers writing guidelines and internal rules)

Related (personal settings / external connection requirements)

Tips for using it well

If you set up IP address restriction before you start production use, your own IP address is automatically added if it is not already included. Owners also cannot log in from an IP address outside the allowed settings, so be careful if you configure this from a network other than the one you normally use.
Before turning on MFA mandatory, owners must register for MFA themselves (if you turn it on without registering, you will lock yourself out).
Before turning on Enforce SSO (prohibit logins other than SSO), test SSO login with a test user.
The default role thresholds for each feature are Dive's recommendations. Adjust them to match your organization's security policy.