Sign-in and security

How people get into your Roiva account, and the settings that control it.

Signing in

On the sign-in page, enter your work email and password and choose Sign in, or choose Continue with Google or Continue with Microsoft. Google and Microsoft sign you in when the email on that account matches your Roiva user and they've verified it. A Microsoft work or school account counts as verified only when its organization has proven to Microsoft that it owns the email's domain; otherwise Roiva refuses it, so sign in another way. A work or school account also needs an email address on its user in Microsoft Entra ID, which your IT admin can add; without one, Microsoft sends Roiva no email to match. If the email doesn't match anyone, Roiva takes you to sign up instead. If you were invited, it accepts the invitation.

If your organization uses single sign-on, sign in from its own sign-in page instead (see below). If it has turned off other ways to sign in, a password, Google and Microsoft are all refused and Roiva sends you to that page.

With Remember me for 30 days checked, you stay signed in on that browser for 30 days. Otherwise you're signed out after 12 hours without activity. Signing out ends your sessions on every device and browser, not only the one you're in. Changing your password ends your other sessions and keeps you signed in where you changed it, and resetting it signs you out everywhere. Turning two-factor on, switching between the app and text messages, or changing your number does the same as changing your password: your other sessions end, including browsers you asked to remember, and you stay signed in where you made the change.

Resetting your password

Choose Forgot password? on the sign-in page, enter your work email, and choose Send reset instructions. The link in the email works for 6 hours. Enter a new password twice and choose Update password, then sign in with the new password. If you use two-factor, Roiva asks for your code as usual: resetting a password never skips it.

A password needs at least 12 characters, with at least three of: an uppercase letter, a lowercase letter, a number, and a symbol. The same rule applies when you sign up, accept an invitation, or change your password.

Changing your password or email

Profile → Security. Profile is in the menu under your name at the bottom of the sidebar.

Enter your current password and the new one twice, then choose Update Password.
Enter a new email address and your current password, then choose Update Email. Roiva emails a link to the new address. Open it while signed in to Roiva and choose Change my email; until then your email stays as it was. The link works for 24 hours, once, and changing your password cancels it. If the new address already has a Roiva account, no link is sent.

Both changes are recorded in the audit log and emailed to you. A new email address is told to the old one, so if someone else changes it, the address they took it from hears about it.

Two-factor authentication for yourself

Two-factor adds a six-digit code to signing in, from an authenticator app (Google Authenticator, 1Password, Authy, or similar) or by text message. Use the app if you can: a text can be intercepted, or redirected by someone who takes over your phone number.

Open Profile → Security and choose Enable 2FA. Enter your current password and choose Confirm, then choose Authenticator app or Text message. If your organization doesn't allow text messages, Roiva goes straight to the app. Finish the next step within 10 minutes, or Roiva asks for your password again. If you signed up with Google or Microsoft and never set a Roiva password, set one first with Forgot password? on the sign-in page.
For the app, scan the QR code, or type in the secret shown under it, and enter the code the app shows. For text messages, enter your mobile number, tick the box agreeing to receive codes by text, choose Text me a code, and enter the code you receive.
Save the backup codes Roiva shows you. Each one signs you in once if you lose your phone or app, and they aren't shown again.

From then on, after your password, Google or Microsoft, Roiva asks for a verification code: from your app, or texted to you as you sign in. Enter it, or a backup code, and choose Verify and continue. A texted code works once, for 10 minutes; Text me a new code sends another after a minute. Roiva can't tell whether your Google or Microsoft account has two-factor of its own, so it asks either way.

Texts go to mobile numbers in the US, Canada, the UK, Ireland and much of Western Europe. Message and data rates may apply; see the text message terms.

Signing in through your organization's own single sign-on doesn't ask for the code. Your identity provider's checks apply instead, because your organization sets them.

To manage it later, open Profile → Security and choose Manage 2FA. There you can see how many backup codes you have left. To generate new backup codes (which replaces the old ones), switch between the app and text messages, change your number, or turn two-factor off, first confirm it's you with your password and a current code or a backup code. If you never set a Roiva password, set one first as above. You can't turn two-factor off while your organization requires it. Two-factor protects signing in with a password, Google or Microsoft, so set it up after signing in one of those ways. While you're signed in through your organization's own single sign-on, two-factor can't be set up, and its method or number can't be changed; turning it off or getting new backup codes still asks for your password and a current code.

Each of those changes is recorded in the audit log and emailed to you, so you hear about a change you didn't make.

If you've lost your phone or app and your backup codes, email success@roiva.ai.

Requiring two-factor, or allowing only single sign-on

Owners and Admins can change these on Organization Settings → Security, then choose Save:

Require 2FA for all members: anyone who signs in with a password, Google or Microsoft and hasn't set up two-factor is sent to set it up before they can continue, and can't turn it off. Someone who signs in through your own OAuth or SAML provider isn't asked, because your provider's checks apply. That holds in your account only: a person signed in through another organization's provider who opens your account is signed out and has to sign in to yours, where your two-factor rule applies to them as to anyone else.
Allow sign-in codes by text message: unchecking it means members can't choose text messages, and anyone who uses them is sent to switch to an authenticator app before they can continue.
Allow sign-in with a password, Google or Microsoft: unchecking it means members whose email is on one of your verified domains sign in only through your own OAuth or SAML provider. For them a password, Google or Microsoft is refused, and they're sent to your account's sign-in page. People you invite on those domains accept by signing in through your provider. Members on other domains, a contractor's say, keep a password, Google or Microsoft, with your two-factor rule. You can't uncheck it until an OAuth or SAML provider is enabled, a domain is verified, and you've signed in through that provider yourself, from your account's sign-in page: that shows it works before it's the only way in. Removing or disabling your last enabled provider, or removing your last verified domain, checks it again. If your provider stops working later (an expired certificate, say), members on your verified domains can't sign in until an admin fixes it from a session that still works, so keep your provider's certificate current.

Every change here is recorded in the audit log.

Single sign-on

Single sign-on comes with every plan, the free account included: Owners and Admins can let your team sign in through your identity provider. On the free account you set it up yourself with the steps below; Roiva doesn't help with the setup.

Your identity provider signs in only people whose email is on a domain your account has verified. Verify each domain their addresses use: a verified example.com doesn't cover eu.example.com, which needs its own record. So start by verifying your domain:

Open Organization Settings → Single Sign-On, enter your domain (such as example.com) under Verified domains and choose Add Domain.
Roiva shows a TXT record: a name (_roiva-verification. followed by your domain) and a value. Add it with whoever runs your domain's DNS.
Choose Check. DNS changes can take a while to appear; check again later if Roiva can't find the record yet.

A domain can be verified by one Roiva account at a time. Removing a domain stops your provider signing in emails on it; those people can still sign in with a password, Google or Microsoft.

Keep the TXT record in place. Roiva looks for it every day, and if it's missing, your account's Owners and Admins are emailed with the date the domain stops counting: 7 days later, unless the record is back by then. Once it stops counting, your provider no longer signs in emails on it, those people sign in with a password, Google or Microsoft, and another Roiva account can verify it. To verify it again, publish the new TXT record shown for it (the old one no longer counts) and choose Check.

If another Roiva account holds your domain (a former employee or contractor verified it, say), delete its _roiva-verification TXT record from your DNS. It stops counting for that account 7 days later, and you can verify it then. If that can't wait, email hello@roiva.ai.

Once a domain is verified, choose Add Provider. The menu lists each identity provider under the protocol it signs in with:

SAML 2.0: Okta, Microsoft Entra ID, OneLogin, Auth0 or Ping Identity. Paste your provider's metadata URL or XML and choose Import metadata to fill in the form, or enter the details yourself. A metadata URL has to start with https:// and be reachable from the internet; for anything else, paste the XML. Give your provider the ACS URL shown on the form, then choose Add Provider.
OAuth: Okta or Microsoft Entra ID. Register the redirect URI shown on the form with your provider, enter the client ID and client secret (plus your Okta org's okta.com address, even if you use a custom domain, or your Entra Directory (tenant) ID, the GUID on your app registration's overview), and choose Add Provider.

A provider shows as a sign-in option only while Enabled for sign-in is checked. To change or remove one, use the menu on its row.

Your provider signs in only members of your Roiva account whose email is on a verified domain. Someone it vouches for on another domain is refused, whoever they are. Someone on your domain who isn't a member is refused and told to ask an admin for an invitation, and someone on your domain with an invitation joins when they first sign in through it.

A sign-in through your organization's provider covers your organization's Roiva account only. If you belong to other Roiva accounts, they aren't listed under Switch Account in that session, and opening one asks you to sign in to it another way: your password, Google or Microsoft. An invitation to another account is accepted, and then you sign in to that account to open it. Your organization's provider vouches for you in its own account, not in anyone else's.

SSO buttons appear only on your account's own sign-in page, not the standard one, because the standard page can't tell which account you belong to. Sign-in through your provider has to start there too: Roiva accepts a SAML response only for a sign-in its own page started, so one your provider sends unprompted (a dashboard tile set up to post straight to Roiva) is refused. To sign in from your Okta or Entra dashboard, point a Roiva tile at your account's sign-in page. Once a provider is enabled, Organization Settings → Single Sign-On and Organization Settings → Security show that page's address to share with your team, with a Copy button.

The audit log

On every plan, Free included, Owners and Admins can see Organization Settings → Audit Log. It records who did what and when, including:

Sign-ins, failed sign-ins and sign-outs, password and email changes, and changes to Organization Settings → Security.
Invitations, role changes and people removed.
Initiatives created and deleted, stage changes, and value approvals.
Connections added, disconnected or given new credentials.
Data exports, and MCP tokens issued, revoked and used.

Search it by action or record type, and choose Export to download what you're looking at as CSV or Excel.

Inviting your team covers roles and who can open Organization Settings.
Your data: exports and deletion covers deleting your own user from Profile → Security.
What Roiva keeps from each platform lists what each connection syncs and stores, and for how long.