Security and sign-in

Ganttry protects each account against password guessing, ends sign-ins that are old or left unused, keeps every company's projects to that company's own people, and gives company admins a record of what happened and a way to shut an account off at once.

Where to find it#

The sign-in protections work on their own, for everyone. Company admins find the company's record on the Company page › Activity, and each person's account actions on Users & access.

Wrong passwords#

After five wrong passwords in a row, the account is locked for 30 seconds. After that, each further wrong password locks it again, for twice as long each time, up to 15 minutes. A successful sign-in clears it. While it is locked, sign-in says "Too many attempts — try again in a moment". A wrong current password in Change password… counts the same way.

Ganttry answers an unknown email address exactly as it answers a known one, so nobody can use the sign-in page — or Forgot password? — to find out whether an account exists.

How long a sign-in lasts#

A sign-in lasts 30 days at most, and ends sooner if the device goes two weeks without using Ganttry. So a device you use every day stays signed in for the full 30 days, while a tablet left in a drawer asks for the password again after two weeks.

• Sign out in the avatar menu ends the sign-in on that device.
• Setting a new password from an invite or reset link signs the account out everywhere else.
• A company admin's Set new password… or Disable account signs the person out on all their devices.
• Change password… keeps you signed in and cancels any invite or reset links still outstanding for you.

Your company's projects stay yours#

Every request is checked against the person's memberships. A project outside your companies and groups doesn't show as a locked item — for you, it isn't there at all. The roles and what each one opens are on Companies, groups and roles; profile pictures are shown only to people who share a company with their owner, and to the instance admin.

Recent activity#

Company admins see the company's record on the Company page › Activity › Recent activity: saves and admin actions in one feed, newest first — who saved what, who was invited, whose role or access changed, what billing did. It holds the latest 100 entries.

• The menu narrows it to Everything, Saves, Projects, Users & access, Billing or Company & groups; the search box filters by name or project.
• The Who column names the person. Entries with no person say Stripe for billing events or Ganttry for entries Ganttry wrote on its own.

Disabling a user#

When someone leaves, or a device is lost, disable their account: Users & access › Users › Disable account on their row. It asks first — "This signs them out on all devices, and they can't sign in again until you enable the account." Their projects and history stay, and their license is freed. Enable account lets them back in.

To take someone out of the company for good, Remove them instead — see Invitations and password resets.

Links and payments#

• Invite and reset links work once and expire; see Invitations and password resets.
• API tokens and the webhook's signing secret are shown once; see Integrations for keeping them safe.
• Card numbers never touch Ganttry — Stripe hosts every payment page.

Who can use it#

Everyone is covered by the lockout and the sign-in rules. Recent activity, disabling and removing people are for company admins (and partner staff for the companies their partner looks after). See Who can see and do what.

Good to know#

• Ordinary project saves appear in the feed as saves; a project's earlier plans are kept in its History — see Saving and history.
• Saving, changing and deleting a saved version each add a row, saved version, changed version or deleted version, shown under Everything. Every restore from History, whether of a saved version, an automatic save or a "Before restoring …" row, adds two: restored project and restored version, the second naming what was restored. Projects shows both beside the other project rows.
• Change password… doesn't sign out your other devices. To end every sign-in on an account at once, a company admin uses Set new password… or Disable account.