Security & Access Restrictions

Beyond what a role can see and do, YSUITE lets you control where and how a role is allowed to log in.

Requires admin access.

IP-based login restrictions

1. Go to Settings → Identity & Access → Roles, and open a role.
2. Under Login Restrictions, add the IP addresses or ranges the role is allowed to sign in from.
3. Save — sign-in attempts for that role from outside the allowed list are blocked.

This is set per role, so different teams can have different restrictions — for example, requiring finance staff to sign in only from the office network, while field sales has no restriction.

HR Admin allow-list

HRMS keeps a separate access control on top of the normal role system: a dedicated HR Admin allow-list, configured by an organisation admin, controls who can access HR Admin screens at all — see Employees.

Authentication

YSUITE uses JWT-based authentication for API access, and OTP verification during sign-up and password reset — see Quick Start.

Tips

• Set IP restrictions on roles handling sensitive data (payroll, accounting) even if you don't restrict every role — it narrows where a compromised credential is actually useful.
• Test a new login restriction from an allowed network before rolling it out — an overly narrow IP range locks out the very people it was meant to protect.