Security Policies

Under Settings → Workspace → Security → Security Policies page lets admins define password rules, session timeouts, login protection, and trusted sources for embedding content across the entire Tellius environment.

Username case sensitivity: Determines whether usernames are treated as case-sensitive. If enabled, JohnDoe and johndoe are treated as two different users.

Strong password check: Requires users to create secure passwords using rules such as a minimum length, special characters, upper- and lower-case letters, and numbers.

Enable auto-login for SSO: Automatically signs users in through their SSO provider for a smoother experience.

• If enabled, users are redirected and signed in through their SSO (for example, Okta or Azure AD) without clicking "Login".

• If disabled, users must start the login manually even when SSO is configured.

Creation of user accounts: Controls whether new user accounts can be created in Tellius.

• If enabled, accounts can be auto-provisioned (for example, on first SSO login) or created manually by admins.

• If disabled, only existing accounts can log in, and no new user profiles are created.

Enable New SAML Flow: Turns on Tellius's newer SAML authentication flow. Leave this off unless your SAML setup requires it.

Restrict sharing without write access: Prevents users who lack write permissions from sharing content.

• If enabled, only users with write access can share Vizpads, Insights, and similar objects.

• If disabled, all users, including view-only users, can share content.

Deployment Type: Sets the tenancy mode for this environment. Two options are available: Single Tenant and Multi Tenant. Selecting Multi Tenant disables sharing completely and restricts the user list API so that only admins and super users can access it. Single Tenant is the standard mode without those restrictions.

• Single Tenant: choose this for a normal deployment where people collaborate. Users can share Vizpads, Insights, and other content with each other, and the user list is available as usual.

• Multi Tenant: choose this when users must be walled off from one another, for example an embedded/OEM setup where one Tellius instance serves multiple end customers who should never see each other's content or be able to enumerate other users through the API.

Enable CAPTCHA: When enabled, Tellius shows a CAPTCHA challenge during login to help block automated login attempts.

Max Login Attempts: The maximum number of consecutive failed login attempts allowed before the account is temporarily locked. Must be between 1 and 10.

Login Lockout Duration (minutes): The length of time, in minutes, a user is locked out after exceeding the maximum number of failed login attempts. The lockout resets after this period.

CAPTCHA Trigger Threshold: The number of failed login attempts after which a CAPTCHA challenge is presented. Must be less than or equal to Max Login Attempts. Applies when Enable CAPTCHA is turned on.

Idle session timeout: Automatically logs users out after a period of inactivity to protect sensitive data. Set both the value and the time unit (minutes, hours, or days). The minimum allowed is 15 minutes and the maximum is 7 days.

Web Configurations

Trusted Origins: A list of approved domains allowed to embed or interact with Tellius content, such as internal web apps, authorized cloud services, or localhost addresses. Only these domains can securely interact with Tellius through embedded Vizpads or APIs.

The URLs you add here are used to validate CORS and Frame Ancestor Origins.

• CORS (Cross-Origin Resource Sharing) controls whether one website is allowed to use resources from a different website (which external origins may call Tellius resources).

• Frame Ancestor Origins specify which sites are allowed to embed Tellius (for example, inside an iframe).

To add an origin, type a fully qualified domain (for example, https://embed.tellius.com or https://*.yourdomain.com) into the field, then press Return or click ADD. Each added origin appears as a chip below the field; click the X on a chip to remove that origin.

Click Save to apply all changes, or Cancel to discard them. Changes are applied immediately and may affect session behavior, user access, and embedding permissions across Tellius.