Overview
To help teams streamline access requests, organizations can configure access request settings to automatically approve requests (based on certain requirements), block certain email domains, and configure access for a specific period of time.
Settings
In the Trust Center, navigate to the Settings page > Accounts & NDAs tab.
Block Requests
There are two options to block requests.
Block requests with non-work emails
SafeBase maintains a large list of known non-work email domains.
If a net-new non-work email is identified, please reach out. The SafeBase team can add it to the list.
Block requests with specific email domains
Learn more about blocking access requests here.
Automatically approve access requests
The options to configure how access requests are approved.
Option 1: Never
Choosing Never means no request is auto-approved, but your other automations still run: accounts you approve can still expire on schedule, matching requests can still be auto-declined before reaching your queue, and CRM data still syncs.
Limit new account access to a restricted period
Sets a global expiration (1-365 days, starting when the first account member logs in) for every new account.
This is the same global setting described in Accounts - Revoke Access & Expiration Options.
Don't set this too short, or accounts may lose access before finishing their security review.
Automatically decline access requests
Lets the SafeBase team configure bespoke Rules Engine logic that automatically declines a request based on a CRM field (for example, a Customer Status of "Churned" or "Competitor") before it ever reaches your manual review queue.
This isn't self-serve; contact SafeBase to set it up.
A custom decline message can be shown to the requester.
Retrieve Account details from CRM
Pulls Account Type and Opportunity/Deal Stage from Salesforce into the Accounts table, Questionnaires table, and Dashboard.
Requires Enterprise Analytics to be enabled by the SafeBase team and additional Salesforce field permissions.
Learn more in Integration - Salesforce - Enterprise Analytics.
Option 2: If request meets conditions
Requests are automatically approved and assigned to an account if the request meets at least one of the following conditions:
Invited colleague's domain matches the inviter's domain - The invited user's email domain matches the inviter's domain, or another domain already on the inviter's account.
An Account exists in SafeBase - The requester's email domain (and company name, if you turn on the company-name matching setting below) matches an existing account in SafeBase.
Contact exists in Salesforce - The requester's email address belongs to a Contact in Salesforce.
Contact domain exists in Salesforce - The requester's email domain is found on any Contact in Salesforce.
If no condition is met, the request requires manual approval. Approved requests are assigned your default NDA provider and default Permission Profile.
Requester's company name must match the account name found in SafeBase
When turned on, SafeBase only matches a requester to an existing account if their company name matches it exactly, in addition to the domain match.
Use this if you have multiple accounts sharing a domain and want name-based precision.
Send Slack notifications about automatically-approved access requests
By default, your Slack integration only posts requests awaiting manual review.
Turn this on to also post automatically-approved requests.
Note: The Salesforce-based conditions require a self-serve Salesforce CRM integration, available on Advanced and Enterprise plans. HubSpot and Microsoft Dynamics don't currently support self-serve auto-approve; use the Custom option below instead.
Because this option can auto-approve requests, all other settings can be apply:
Limit new account access to a restricted period
Sets a global expiration (1-365 days, starting when the first account member logs in) for every new account.
This is the same global setting described in Accounts - Revoke Access & Expiration Options.
Don't set this too short, or accounts may lose access before finishing their security review.
Automatically decline access requests
Lets the SafeBase team configure bespoke Rules Engine logic that automatically declines a request based on a CRM field (for example, a Customer Status of "Churned" or "Competitor") before it ever reaches your manual review queue.
This isn't self-serve; contact SafeBase to set it up.
A custom decline message can be shown to the requester.
Retrieve Account details from CRM
Pulls Account Type and Opportunity/Deal Stage from Salesforce into the Accounts table, Questionnaires table, and Dashboard.
Requires Enterprise Analytics to be enabled by the SafeBase team and additional Salesforce field permissions.
Learn more in Integration - Salesforce - Enterprise Analytics.
Option 3: Custom
Requesters are automatically approved and assigned to an account if the request meets at least one of the following conditions:
Invited colleague's domain matches the inviter's domain - same as in Option 2.
An Account exists in SafeBase - same as in Option 2.
Meets custom requirements - the request matches bespoke approval logic built for your organization (for example, a Salesforce Customer Type, ARR range, or Opportunity stage).
Important note: This option only appears once the SafeBase team has configured custom Rules Engine logic for your organization. It isn't self-serve: contact your CSM or SafeBase Support to set up these rules. Custom is available on Enterprise plans only.
If no condition is met, the request requires manual approval. Approved requests are assigned your default NDA provider and default Permission Profile.
Requester's company name must match the account name found in SafeBase
When turned on, SafeBase only matches a requester to an existing account if their company name matches it exactly, in addition to the domain match.
Use this if you have multiple accounts sharing a domain and want name-based precision.
Send Slack notifications about automatically-approved access requests
By default, your Slack integration only posts requests awaiting manual review.
Turn this on to also post automatically-approved requests.
Because this option can auto-approve requests, all other settings can be apply:
Limit new account access to a restricted period
Sets a global expiration (1-365 days, starting when the first account member logs in) for every new account.
This is the same global setting described in Accounts - Revoke Access & Expiration Options.
Don't set this too short, or accounts may lose access before finishing their security review.
Automatically decline access requests
Lets the SafeBase team configure bespoke Rules Engine logic that automatically declines a request based on a CRM field (for example, a Customer Status of "Churned" or "Competitor") before it ever reaches your manual review queue.
This isn't self-serve; contact SafeBase to set it up.
A custom decline message can be shown to the requester.
Retrieve Account details from CRM
Pulls Account Type and Opportunity/Deal Stage from Salesforce into the Accounts table, Questionnaires table, and Dashboard.
Requires Enterprise Analytics to be enabled by the SafeBase team and additional Salesforce field permissions.
Learn more in Integration - Salesforce - Enterprise Analytics.
Option 4: Always
Requesters will be automatically approved and assigned to an account with their company name. If no account exists, requesters will be assigned to a new account. Accounts will be created with your default NDA provider.
You can also enable the following options:
Send Slack notifications about automatically-approved access requests
By default, your Slack integration only posts requests awaiting manual review.
Turn this on to also post automatically-approved requests.
Limit new account access to a restricted period
Sets a global expiration (1-365 days, starting when the first account member logs in) for every new account.
This is the same global setting described in Accounts - Revoke Access & Expiration Options.
Don't set this too short, or accounts may lose access before finishing their security review.
Automatically decline access requests
Lets the SafeBase team configure bespoke Rules Engine logic that automatically declines a request based on a CRM field (for example, a Customer Status of "Churned" or "Competitor") before it ever reaches your manual review queue.
This isn't self-serve; contact SafeBase to set it up.
A custom decline message can be shown to the requester.
Retrieve Account details from CRM
Pulls Account Type and Opportunity/Deal Stage from Salesforce into the Accounts table, Questionnaires table, and Dashboard.
Requires Enterprise Analytics to be enabled by the SafeBase team and additional Salesforce field permissions.
Learn more in Integration - Salesforce - Enterprise Analytics.