Sign inStart free trial
  1. Help center
  2. Security and audit
For: Firm admins6 min read

Security and audit

Everything in this guide lives in Security & Audit. Every change you make here is itself recorded in the audit log.

Sign-in

  • People sign in with Google Workspace or Microsoft Entra ID. Firms can also sign in with a workspace access code.
  • Turn on Require MFA to reject any sign-in without verified MFA. Rejections are recorded as auth.mfa_rejected.

Sessions

  • Anyone can see their own active sessions and revoke one.
  • As an admin, use Revoke sessions to sign a person out everywhere. Use it for a lost laptop or a departing contractor.
  • Deactivating a person revokes their sessions automatically.

Audit log

The audit log records who changed what and when: people, roles, rates, financial access, templates, SOWs, estimates, approvals, client links, sessions, imports and exports. Each record has the actor, the action, the object, the values before and after, and a UTC time. Records cannot be edited or deleted.

  1. Filter by action, object type, person or date range.
  2. Download the filtered view as CSV for an investigation or a client's security review.

Respond to a compromised account

  1. Revoke the person's sessions, or deactivate them.
  2. Filter the audit log by that person and the time window.
  3. If a client link went to the wrong person, revoke the link from the SOW.

Leaving Stafio

Download the full firm archive and CSV exports. After cancellation your firm stays exportable, read-only, for 30 days, and is then permanently deleted.