Setting Up Dedupely for Your IT and Security Team

When IT or security reviews Dedupely, they usually ask the same things: how people sign in, who can see and change what, which login rules apply, what's logged, and where the data lives. This playbook walks you through each of them in Dedupely, in the order most IT teams set them up, with the settings to choose and what to share with your security team. Single sign-on (SSO), user provisioning (SCIM) and Google Workspace sync are on every paid plan.

The checklist

Step 1: Connect your identity provider

In Company Settings → Sign-in & Provisioning:

1. Single sign-on: click Set up on the Single sign-on card and connect your identity provider: Microsoft Entra, Google Workspace, Okta, Auth0, OneLogin, PingOne, JumpCloud, Cisco Duo, Amazon Cognito, IBM Verify, SAP Cloud Identity or CyberArk Identity. Dedupely uses OpenID Connect: in your identity provider, create a web application with the authorization code flow and the redirect URI shown in Dedupely (https://auth.dedupe.ly/redirect/sso-login). Then enter its Issuer URL, Client ID and Client secret in Dedupely, click Save connection and Complete.
2. Verify your domains: confirm your company domains with a DNS record.
3. Choose how members stay in sync:

• User provisioning (SCIM): your identity provider adds, updates, deactivates and removes people in Dedupely as they join, change or leave. Available with Microsoft Entra, Okta, Auth0, OneLogin, PingOne, JumpCloud, IBM Verify, SAP Cloud Identity and CyberArk Identity.
• Google Workspace sync: from Users → Directory Sync & Provisioning.

4. Default role for new users: choose the role people get when SCIM or Google Workspace sync creates them. Existing users keep their roles. Pick the role with the least access most people need, like Read-only User or Data Manager, and give more access by hand.

Once SSO works, you can also require it, so your team signs in only through your identity provider. See Single Sign-On and Provisioning.

Users you import from your CRM become inactive when they're deactivated in the CRM.

Step 2: Give each person only the access they need

Every person has one or more roles, and each role sets No access, Read or Read & Modify for each part of Dedupely:

• Limit people to their own records: check Own CRM records only on a role, so its members only see the records they own in your CRM.
• Give temporary access with an expiry date, for consultants or auditors. Leave it blank for permanent access.
• Check what someone can do with View permissions on the Users page.

Users are unlimited on every plan, with no per-user fees. See Roles and Permissions and Users.

Step 3: Set your login rules

In Company Settings → Security Policy:

• Password: set a minimum length (12 characters by default), make passwords expire every 30, 60, 90 or 180 days, and turn on Password reuse prevention.
• Two-factor methods allowed: check Enforce 2FA, and choose which methods people may use: Authenticator app, Security keys and Email code. If you stop allowing a method someone uses, they confirm it's them with a method they have at their next sign-in, then set up an allowed one, so nobody is locked out. People you invite set up 2FA before they join.
• Inactive sessions: turn on Close sessions when inactive, so unattended screens are logged out.
• IP Whitelist: add your office or VPN IP addresses. Only people on those addresses can log in; everyone else is blocked.

Click Save Security Settings after any change.

Use the Login Security Score as your checklist

The Login Security Score panel rates your settings out of 100. It checks five protections, worth 20 points each:

1. Enforce 2FA for all users.
2. Enable password expiration.
3. Keep password expiration at 90 days or less.
4. Use passwords with at least 12 characters.
5. Enable Close sessions when inactive.

Hover over or select an item to find its setting. A score of 100 means all five are on. See Security Policy.

Several CRMs connected? Each connected CRM has its own Security Policy, users and Audit Log, so set them up in each one. See Several CRMs in One Dedupely Account.

Step 4: Know where activity is logged

• Audit Log: every action in your account, including merges, scans, changes to Duplicate Searches, user invitations, role changes, logins, logouts, 2FA attempts and security setting changes, with the user and the time. Entries are kept indefinitely, and you can filter by date. Viewing it needs access to the Audit log. See Audit Log.
• Merge History: every merge, with who ran it, the original records and the values that won. See Merge History.

Step 5: Share the documents your security team needs

• Certifications: Dedupely is ISO 27001:2022 certified, including ISO 27017 and ISO 27018.
• Hosting: AWS and Google Cloud, North Virginia (USA).
• AI: your CRM records are never sent to, processed by or used to train third-party AI models, including in Dedupely Intelligence.
• CRM connection: HubSpot, Salesforce and Pipedrive connect through OAuth, with access tokens rotated continuously. Connecting and syncing never change anything in your CRM.
• Disconnecting: Dedupely revokes its access where your CRM allows it, and stops syncing.
• After you cancel: your data is deleted automatically.
• Where to find the documents: the Trust Center (audits, reports, sub-processors), Security and the Data Processing Addendum.

See Security and Privacy of Your Data.

Example setup

A 300-person company with Okta and HubSpot:

1. Sign-in: SSO with Okta, domain verified, SCIM turned on, and SSO required. Default role for new users: Read-only User.
2. Roles: two Admins in RevOps, three Data Managers, one Accountant in Finance, and a custom "Security reviewer" role for the IT lead.
3. Security Policy: 2FA enforced with Authenticator app and Security keys only, passwords of 14 characters that expire every 90 days, reuse prevention on, sessions closed when inactive, and the office VPN on the IP whitelist. Login Security Score: 100.
4. Review: the IT lead checks the Audit Log every quarter for role changes and security setting changes.

Common mistakes

• Making everyone an Admin. Keep Admin to 1–2 people, and give everyone else the role they need.
• Setting a broad default role for new users. Everyone SCIM or Google Workspace sync adds gets it. Start with the least access.
• Enforcing 2FA without telling your team. People set it up at their next sign-in. Let them know first.
• Adding an IP whitelist without your VPN. People working remotely get blocked.
• Forgetting other connected CRMs. Each one has its own Security Policy.

FAQs for IT and security teams

• Does Dedupely support SSO? Yes, on every paid plan, through OpenID Connect, with 12 identity providers including Microsoft Entra, Google Workspace and Okta.
• Does Dedupely support SCIM? Yes, on every paid plan, with 9 identity providers. Google Workspace sync is also available.
• Can we require SSO? Yes. Once it's set up, people can be required to sign in through your identity provider.
• Which 2FA methods are available? Authenticator app, security keys and email code, plus backup codes. You choose which ones are allowed.
• How long is the Audit Log kept? Indefinitely.
• Is our CRM data used to train AI? No. It's never sent to or used to train third-party AI models.
• Where is our data hosted? In the AWS and Google Cloud North Virginia (USA) regions.