In the Security page of the admin panel, you can customize your Lucid security settings to match the needs of your organization.

Some security features are only available to Enterprise accounts. To upgrade to an Enterprise account, check out our Upgrade your Lucid account article.

Access the Security page

To get to the Security page, follow these steps:

Select Admin.
Click Security in the left-hand menu.

Enable Domain Control

Domain Control is an Enterprise only feature that allows you to control the security settings for users on your domain and set security standards for your entire organization. With domain control enabled on your Lucid account, users are prevented from creating unauthorized teams with the controlled domain.

When you enable domain control, users who attempt to sign up for a Lucid account will be notified that an enterprise account already exists and will be redirected to verify their identity. Once they verify their identity, they’ll be added to your organization’s Lucid account.

The method you select to verify users' identities should match the default user sign in authentication method set for the account.

Select one of the following options for verifying user identity:

Confirmation email: The user receives an email with a confirmation link.
SAML authentication: The user is redirected to your organization’s SAML instance.
Google SSO authentication: The user is redirected to authenticate via Google SSO.
Office 365 SSO authentication: The user is redirected to authenticate via their Office 365 credentials.
Redirect to custom authentication URL: The user is redirected to a different SSO provider via an authentication URL.

Note: Due to the security demands of domain control, you will need to contact your Account Manager, Customer Success Manager, or contact sales to request set up.

Domain verification

Domains are verified for two purposes–consolidations and domain control.

Domain verification is a process that confirms ownership of specific domains prior to locking down a domain to be controlled by a single account or consolidating users who are on those domains. For security and data privacy reasons, Lucid is obligated to follow a specific procedure to verify that an account who's asking to consolidate or control a specific domain does own that domain.

Domain verification must occur if both of the following are true:

The domain to be consolidated or controlled is different from the Account Owner's domain (referring to their email address on the account).
There are no users on the account with the same domain as the one to be consolidated or controlled.

Domain verification methods

Lucid offers three ways to verify your domain:

Hosting Validation
DNS Record Validation
Email Validation

To request a domain verification for your Enterprise account, contact your Account Manager, Customer Success Manager, or contact sales and provide the following details:

The domain(s) to be verified.
Email address(es) and name(s) of the web-administrators of those domains (if verifying domain via Hosting or DNS Record Validation).
Email address(es) and name(s) of the Lucid admin(s).

Domain controlled account invitations

check-box-to-enable-or-disable-document-invitation-previews.png

Determine whether users on the same domain can email you a request to join your team when they create a Lucid account. If you uncheck this box, you will no longer receive join requests and the next largest account with the same domain will receive the requests.

Determine whether users on your team can leave by accepting an invitation to another team account. Allowing users to leave your team without express action from an admin is defaulted to off. Selecting that option will allow your users to accept explicit invites from other Teams.

Note: If a user leaves your team via an invitation, they will by default take their documents with them. However, if their documents are organized within a team folder, the documents will not be transferred with the user.

Allow non-admins to invite new users to team

Here you can indicate the ability for non-admin users on your account to invite new users to join the account.

Your options include:

No restrictions. All users can invite new users.
All users can invite other users with the same—or approved—domains.
All users can invite new users from domains listed here.
Total lockdown. Only the account owner and team admins can invite new users.

Authentication sign-on methods

Select Authentication from the Security dropdown in the left-hand menu to access user sign-on and password settings.

The sign-on methods currently supported in Lucid are as follows:

Email and Password
Google SSO
Office 365 SSO
Slack
SAML (Enterprise only)

Note: Lucid users can set up multi-factor authentication (MFA) via SSO login with Google or Microsoft. Enterprise accounts can set up multi-factor authentication via an Identity Management Provider (IDP).

Default authentication

Your team’s default authentication method is the login method users will encounter when they click Next or hit the "Enter" key after typing their email address into the Lucid login page.

The default authentication method selected should match the method selected to verify users identity (please see domain control section).

SAML (Enterprise only)

If you’re using SAML sign-on, SAML should be set as the default authentication method. If it’s not, users will be able to access Lucidchart, Lucidspark, and Lucidscale via your IDP, but will not be able to use SAML sign-on via the Lucid log in page.

Restrict user log in to allowed IP addresses

If you’d like your employees to only be able to log into their Lucid account from specific locations, check this box and list certain IP addresses by typing them into the field below. This feature requires CIDR notation to denote IP ranges, e.g. 192.168.2.0/24.

Note: This feature will not prevent users from logging in with an allowed IP address and then moving to another address that is not listed.

Set a password policy

If your organization allows email and password log in, you can change the settings in Authentication from the dropdown under Security in the left-menu to increase the security of your users’ passwords.

On Team and Enterprise accounts, this includes setting a minimum number of characters, as well as specifying whether at least one of each of the following items are requested: upper case character, numeric character, symbolic character.

password-restrictions-if-email-and-password-allowed-for-Lucid-sign-in.png

Additional password restrictions available to Enterprise accounts only include setting a limit to failed login attempts allowed before lockout, along with the lockout duration period, requiring users to change their passwords after a certain amount of time, and preventing reuse of previously used passwords.

password-restrictions-available-on-enterprise-account.png

Force password reset

By selecting Force Password Reset you can force a password reset for every member of your organization. When a user logs in after you do this, they will be prompted to change their password.

Adjust sharing settings

As an Account Owner or Team Admin, you can adjust the sharing settings by selecting Sharing from the Security dropdown in the left-hand menu. Across the top of the page you will see a tab for Sharing settings, Document ownership transfer, and Editor experience.

Basic sharing

Document and folder sharing
If you want to grant your Team or Enterprise users the ability to share documents, images, and folders with all users on the account at once, check this box.

check-box-to-enable-or-disable-sharing-across-your-lucid-account.png

Document invitation previews
If you want document invitations that users on your account send out to include a preview of the document, check this box.

check-box-to-enable-or-disable-document-invitation-previews.png

Image sharing
You can select the option to restrict Lucidchart users to share specific images or opt to have all images shared automatically.

image-sharing-options-for-lucid-team-or-enterprise-account.png

Advanced sharing (Enterprise only)

Shareable link

This setting gives you control over whether users on your account can create shareable links to the Lucidchart documents, Lucidspark boards, and Lucidscale models on your account.

Public: Grant users the ability to generate a share link that is accessible to any user.
Restricted: Grant users the ability to generate a share link that will only be accessible for other users on the account.
Off: Disable ability for users to generate shareable links.

shareable-link-restriction-options-for-lucid-account.png

Expiring share links

To set a default expiration for all newly created share links, check the box and select a time frame for all links to expire. Users will be able to set a shorter time frame for expiration in an individual document or board, but will not be able to set an expiration for longer than the default you set here.

Keep in mind:

A default expiration applies only to share links created after the setting is enabled.
The default expiration setting applies to share links only. This means all collaborators who accessed the document prior to the link expiring will continue to have access to the document. To revoke access from a collaborator, you will need to unshare the document or board with them.

check-box-to-set-parameters-for-expiring-share-links.png

Guest Collaborator access in Lucidspark

Enable or disable the generation of Guest Collaborator access links for Lucidspark boards. To learn more, see our Guest Collaborators in Lucid article.

check-box-to-enable-or-disable-guest-collaborator-link-creation.png

Enable Join ID

Enable or disable the generation of a 6-digit Join ID code for your Lucidchart documents, Lucidspark boards, and Lucidscale models.

Sharing permissions for Join ID links:

Public with Guest Collaborators (Lucidspark only): If your account has shareable links set to Public and has Guest Collaborator access links enabled, using Join ID will grant Guest Collaborator access to recipients. If your account has shareable links set to Public and has Guest Collaborator access links disabled, using Join ID will grant Public - Edit and Share access to recipients.
Public: If your account has shareable links set to Public, using Join ID will grant Public - Edit and Share access to recipients.
Restricted: If your account has shareable links set to Restricted, using Join ID will grant Restricted to Account - Edit and Share access to recipients.
Off: If your account has shareable links set to Off, Join ID will not work and will instead display an error message.

Sharing via email

When setting the Sharing via Email preferences for your account, you have the following options:

Do not restrict sharing of items via email: users will be able to share documents through email to users on any domain.
Warn team members who share documents to emails outside given domains: a warning message will be sent to a user whenever that user attempts to share a document outside the allowed domains.
Restrict to following domains when sharing an item via email: users will only be able to share documents with other users on allowed domains. If a user attempts to share outside of those listed they will get a notification saying that they are not allowed to do so.

Note: If you have opted to warn or restrict users based on shared-to domains, you will be able to input permitted domains that you would like to allow in the text box at the bottom of the “Domain Restrictions” section. If you don’t do this, everyone on your team will be warned or restricted every time they attempt to share a document.

Publishing and embedding

This setting allows you to control whether users on your account can publish and publicly embed documents to web pages.

enable-or-disable-publishing-and-embedding-on-your-Lucid-account.png

Transfer document ownership settings

This setting allows you to restrict who document ownership can be transferred to. You can opt to remove all restrictions, set it so that document ownership can only be transferred among those on your Enterprise account, or set it so that document ownership cannot be transferred. To see the steps to transfer document ownership, see this article.

Editor experience

In this section of the admin panel, you can enable or disable the ability for users to Chat in Lucidspark, search and use images and icons, and use the standard Lucidchart template library. This is also where you can upload any brand fonts you want to make available to the users on your account.

Chat

To enable the ability for users to chat while editing a board, check this box. Chat functionality is available in Lucidspark only.

Image and icon search

These settings allow you to control the following functionality:

Enable Bing image search to allow users to search for images.
Enable Giphy image search to allow users to search for GIFs.
Enable Icon Finder search to allow users to search for icons.

image-and-icon-search-settings-including-bing-giphy-and-icon-finder.png

Standard templates

Check this box to enable users to use standard Lucidchart templates. Unchecking this box will restrict users to only custom made templates, created either by you personally or by other users on your Team or Enterprise account.

enable-or-disable-standard-template-usage-for-Lucid-account.png

Brand fonts

As a Team or Enterprise admin, you can upload team fonts that can be used by all users on your account in Lucidchart, Lucidspark, and Lucidscale. Here’s how:

Expand the Security dropdown in the left-hand menu of the admin panel.
Click Sharing from the breakdown of left-hand menu options.
Select the Editor experience tab at the top of the page.
Under “Brand fonts”, click the + sign to upload a font file.
Follow the prompts to upload the file.

add-brand-fonts-to-Lucid-account-for-access-across-all-documents.png

Key Management Service (KMS)

Lucid Key Management Service allows businesses to control their own encryption keys for an additional layer of security. Lucid KMS is a paid enterprise add-on feature. To learn more about this service, please see the KMS whitepaper or contact our sales team.

Note: As an Account Owner or Team Admin, you will see the KMS menu option in the Security dropdown in the left-hand menu only if this feature has already been enabled for your account.

For customers with less than 200 licenses they can rotate their Master Key once every week or if there is evidence that Lucid’s security has been compromised. For customers with 200+ licenses they can rotate their Master Key once every 24 hours or if there is evidence that Lucid’s security has been compromised.

Lucid’s KMS BYOK offering includes a Break Glass Key (BGK), which serves as an additional key encryption key for all DEKs. The BGK utilizes asymmetric encryption, with Lucid’s document services holding the public portion of the key. This public key separately encrypts the Data Encryption Keys used to encrypt the customer’s data in addition to the customer’s regular Key Encryption Key. The private portion of the BGK is encrypted, stored in a secure manner, and shared with a group of Lucid executives. Information necessary to decrypt the private portion of the key is securely stored separate from the encrypted key and shared with a different group of Lucid executives. To access the private portion of the BGK, at least two Lucid executives are required - one with access to the encrypted private portion of the key and another with access to information required to decrypt it.

KMS with Bring Your Own Key (BYOK)

The main difference between Lucid KMS and Lucid KMS BYOK is that with BYOK the AWS KMS or CloudHSM that decrypts customer data encryption keys is located in the customer’s AWS account rather than Lucid’s AWS account. The customer is responsible for ensuring their AWS KMS or CloudHSM are configured and operating correctly, otherwise Lucid’s KMS BYOK feature will not function properly, which may impact access to customer data stored in Lucid products. The customer is also responsible for the costs incurred to run the services in their AWS account that support Lucid KMS BYOK.

The Lucid KMS BYOK offering can be configured to not use the BGK, but if it is, Lucid cannot guarantee continued access to the customer’s data in the event of a key-related disaster. If the customer or Amazon prevents Lucid from using the customer's encryption keys, then the customer’s data in Lucid products cannot be decrypted and will be irrecoverably lost.

User feature controls

Developer controls

Restricting Developer controls is only available to Enterprise accounts. When you restrict access to Developer tools, users on your account cannot unlock Developer tools themselves through their Account Settings, but the Account Owner and Team Admins can still assign the role manually through the Users page of the Lucid admin panel.

To see the steps and learn more, read our Developer tools in Lucid article and check out the Admin Controls section of the Lucid Development Guide.

section-of-the-lucid-admin-panel-to-restrict-access-to-developer-tools.png

Collaborative AI

Lucid’s Collaborative AI allows users to brainstorm and build ideas with more creativity and innovation in less time. You can control whether or not to give your team access to this feature by toggling “Enable AI features: Summarize, Generate ideas, and Sort ideas” on or off. Restricting access to Collaborative AI is only available to Enterprise accounts.

For more information, check out our Transform productivity and innovation with Collaborative AI article.

Related articles