Security is where carrier, MGA, and wholesaler administrators tighten organization-wide sign-in for the Turris platform. Today it controls a single but critical lever: requiring every member of your organization to use SMS-based one-time password (OTP) multi-factor authentication on top of the email magic-link login.

Security Settings is the Organization sub-page inside the Settings modal that hardens how members of your organization authenticate into Turris. Instead of leaving multi-factor authentication to each member's own choice, an administrator can flip one toggle and enforce SMS OTP for everyone in the organization in a single action.

Who uses it. Compliance officers, IT administrators, and security leads at carriers, MGAs, and wholesalers, typically the same person who manages user invitations and role assignments under Users (Settings). Their job is to make sure access to producer, policy, and compliance data is protected by a second factor without depending on every member to opt in on their own.

You use Security Settings to:

Security lives behind the global Settings modal, not on a dedicated page, so you can open it from anywhere in the platform.

What's visible on the page:

Note: The Security entry only appears in the Settings navigation if your role grants the Security setting permission. Members without that permission do not see the option at all, which is by design: only users authorized to change organization-wide security policy can reach the page.

When you'd do this. Your organization handles licensing, appointment, and policy data on behalf of agencies and producers, and you want every member's account protected by a second factor at sign-in, without relying on each person to enable MFA on their own profile.

After confirmation, three things change immediately:

Warning: Enabling Require SMS OTP cannot be reversed from this page. The toggle is intentionally one-way to prevent accidental rollback or a downgrade by a member who later gains access to settings.

Tip: Send your team a heads-up before flipping the toggle. Members will be prompted for a phone number on their next sign-in, and roaming or international users may need to confirm their carrier can receive SMS from US numbers.

When you'd do this. You enabled SMS OTP earlier and now need to roll it back, for example because you are switching to a different MFA method, troubleshooting an SMS delivery problem with a member's carrier, or temporarily relaxing the policy during planned maintenance.

Because the toggle is disabled in the UI once enabled, deactivation goes through Turris support:

Note: Until support applies the change, every member continues to be prompted for SMS OTP at sign-in. Sessions that were already active before you requested the rollback remain valid.

Who can change Security settings? Members whose role grants the Security setting permission. Members without that permission do not see the Security entry in the Settings navigation, and if they reach it through a direct link the toggle rejects any change with a permission error.

Why is the toggle grayed out after I enable it? Disabling SMS OTP is intentionally locked behind a support request so the requirement cannot be turned off accidentally or by a member who later gains access to settings. This protects the organization from a one-click rollback of a security policy that took deliberate action to enable.

Will members who are already signed in be logged out? No. Existing sessions remain valid, but every member is required to register a phone number and complete SMS verification on their next sign-in.

What if a member cannot receive SMS messages? Email support@turrisfi.com. Support can reset that member's MFA so they can register a new phone number, or temporarily make SMS OTP optional for the whole organization while you troubleshoot.

Does enabling SMS OTP affect API clients or restricted access tokens? No. Programmatic access configured under the API (Settings) page authenticates with OAuth 2.0 client credentials and restricted access tokens, which do not use a magic link or SMS code. Member-level SMS OTP enforcement does not change how those credentials authenticate.

What if I do not have permission to update the page? The toggle still reflects the current state, but clicking it triggers a red error alert reading "You do not have permission to update security OTP settings." Ask an administrator with the Security setting permission to make the change, or update your role under Users (Settings).

If you have questions about Security Settings or encounter any issues, contact our support team at support@turris.com.