Configure security and privacy

How to get there: Click Settings in the sidebar → Security & Privacy tab (under Users & Access).

These settings control how users access your portal and how their data is handled.

Choose which login methods are available on your portal:

ProductLift login -- the standard email-and-password login built into ProductLift.
Social authentication -- allow users to log in with Google, GitHub, or other social providers. Enable each provider individually.

Single Sign-On (SSO)

How to get there: Click Settings in the sidebar → Security tab → scroll to Single Sign-On (SSO).

Let users log in to your portal automatically from your own application. When SSO is configured, users who are already logged in to your app are seamlessly authenticated in ProductLift without a separate login step. See the SSO documentation for implementation details.

Microsoft 365 / Entra ID SSO

How to get there: Click Settings in the sidebar → Security tab → scroll to Microsoft 365 / Entra ID SSO.

Let your team sign in with their existing Microsoft 365 work account. Login is tenant-restricted, so only members of your organization can sign in, and your existing MFA and conditional access policies in Entra ID apply automatically. See the Microsoft 365 / Entra ID SSO setup guide.

User Acceptance

When enabled, new sign-ups are held in a pending state until an admin approves them. You can also auto-approve users based on their email domain (e.g., approve everyone with an @yourcompany.com address).

Email Verification

Require users to verify their email address before they can post or vote. This helps prevent spam and fake accounts.

Private Portal

Make your portal visible only to logged-in users. Visitors who are not signed in will see a login page instead of your boards. This is useful for internal feedback portals or pre-launch communities.

Portal Password

Hide your entire portal behind a single shared password. Visitors are shown a password prompt before they can see any content; once they enter the correct password, a cookie lets them browse for 30 days without re-entering it. Admins are never prompted, they log in as usual.

Common use cases:

A knowledge base you host for one specific customer
A stealth-launch or beta portal shared with a small invite list
Any KB or roadmap you want reachable by URL but not indexable by search engines

How it works

Set a password in Settings → Security & Privacy → Portal Password (minimum 4 characters).
Share the password with your audience via a private channel (email, DM, contract addendum).
Optional: share a bookmark link in the form https://your-portal.example/?k=YOUR_PASSWORD. The visitor lands, the password is verified, and they are redirected to the clean URL with the cookie set. The password is never left in the address bar after that first hop.

Notes

Setting a portal password automatically disables search-engine indexing for the portal. Google would otherwise cache the unprotected content on its first visit.
The password is stored hashed, so we cannot show it back to you. If you forget it, set a new one and reshare.
Rotating the password immediately invalidates every outstanding cookie. All visitors will be prompted again.
To remove the gate, use the "Clear password" button. The portal becomes publicly reachable again (subject to your other privacy settings).
Portal Password and Private Portal are independent. Enabling both means a visitor must first pass the shared-password gate, then log in with a personal account.

Maintenance Mode

Temporarily block all access to your portal. When enabled, visitors see a maintenance message instead of the portal. Admins can still access the portal normally.

Show a cookie consent banner to comply with GDPR and similar regulations. When enabled, a banner appears asking visitors to accept cookies before any tracking scripts are loaded.

Privacy Statement

Add a link to your privacy statement. This link appears on the registration page and in emails, letting users know how their data is handled.