# Dedupely Setup Checklist for IT and Security Teams | Dedupely

> A checklist for IT and security teams: single sign-on, SCIM, roles, password rules and 2FA, activity logs, and the documents for a security review.

- URL: https://dedupe.ly/knowledge-base/setting-up-dedupely-for-your-it-and-security-team
- Section: knowledge-base
- Site index: https://dedupe.ly/llms.txt
- Any page: append `.md` to its URL for this plain-text form

---

Skip to content
[New Dedupely Intelligence Now on every paid plan, monthly or yearly.](https://dedupe.ly/ai-deduplication)

## Setting Up Dedupely for Your IT and Security Team

By
[Gaby Salinas](https://www.linkedin.com/in/gbyslns)
Updated November 11, 2026
A checklist for IT and security: sign-in, access, password rules, activity logs and what happens to your data.
When IT or security reviews Dedupely, they usually ask the same things: how people sign in, who can see and change what, which login rules apply, what's logged, and where the data lives. This playbook walks you through each of them in Dedupely, in the order most IT teams set them up, with the settings to choose and what to share with your security team. Single sign-on (SSO), user provisioning (SCIM) and Google Workspace sync are on every paid plan.

### Before you start

- **A role that can change these settings.** You need Read & Modify on Security policy and sign-in, Users, and Roles and permissions. The Admin role has all three. See [Roles and Permissions](https://dedupe.ly/knowledge-base/roles-and-permissions).
- **A paid plan** if you want SSO or SCIM. See [Dedupely Pricing](https://dedupe.ly/knowledge-base/pricing).

### The checklist

| **Step** | **What you set up** | **Where** |
| --- | --- | --- |
| 1 | Single sign-on and user provisioning | Company Settings → Sign-in & Provisioning |
| 2 | Roles: who can see and change what | Company Settings → Roles and permissions, and Users |
| 3 | Password rules, 2FA and sessions | Company Settings → Security Policy |
| 4 | Activity logs | Company Settings → Audit Log, and Merge History |
| 5 | Documents for your security review | dedupe.ly/trust and dedupe.ly/security |

### Step 1: Connect your identity provider

In **Company Settings** → **Sign-in & Provisioning**:
- **Single sign-on:** click **Set up**
on the Single sign-on card and connect your identity provider: Microsoft Entra, Google Workspace, Okta, Auth0, OneLogin, PingOne, JumpCloud, Cisco Duo, Amazon Cognito, IBM Verify, SAP Cloud Identity or CyberArk Identity. Dedupely uses OpenID Connect: in your identity provider, create a web application with the authorization code flow and the redirect URI shown in Dedupely (https://auth.dedupe.ly/redirect/sso-login). Then enter its Issuer URL, Client ID and Client secret in Dedupely, click **Save connection** and **Complete**.
- **Verify your domains:** confirm your company domains with a DNS record.
- **Choose how members stay in sync:**
- **User provisioning (SCIM):** your identity provider adds, updates, deactivates and removes people in Dedupely as they join, change or leave. Available with Microsoft Entra, Okta, Auth0, OneLogin, PingOne, JumpCloud, IBM Verify, SAP Cloud Identity and CyberArk Identity.
- **Google Workspace sync:** from **Users**
→ **Directory Sync & Provisioning**.
- **Default role for new users:** choose the role people get when SCIM or Google Workspace sync creates them. Existing users keep their roles. Pick the role with the least access most people need, like **Read-only User**
or **Data Manager**, and give more access by hand.
Once SSO works, you can also require it, so your team signs in only through your identity provider. See [Single Sign-On and Provisioning](https://dedupe.ly/knowledge-base/single-sign-on-and-provisioning).
Users you import from your CRM become inactive when they're deactivated in the CRM.

### Step 2: Give each person only the access they need

Every person has one or more roles, and each role sets **No access**, **Read** or **Read & Modify** for each part of Dedupely:
| **Role** | **Give it to** |
| --- | --- |
| **Admin** | 1–2 people who own the account. The Admin role doesn't expire. |
| **Data Manager** | The people who find and merge duplicates |
| **Accountant** | Whoever manages billing and invoices |
| **Read-only User** | People who only need to see data and results |
| **A custom role** | Anything in between. For example, a "Security reviewer" role with Read on Security policy and sign-in, Users and Audit log, and No access to CRM data. |
- **Limit people to their own records:** check **Own CRM records only**
on a role, so its members only see the records they own in your CRM.
- **Give temporary access with an expiry date**, for consultants or auditors. Leave it blank for permanent access.
- **Check what someone can do** with **View permissions**
on the **Users** page.
Users are unlimited on every plan, with no per-user fees. See [Roles and Permissions](https://dedupe.ly/knowledge-base/roles-and-permissions)
and [Users](https://dedupe.ly/knowledge-base/users).

### Step 3: Set your login rules

In **Company Settings** → **Security Policy**:
- **Password:** set a minimum length (12 characters by default), make passwords expire every 30, 60, 90 or 180 days, and turn on **Password reuse prevention**.
- **Two-factor methods allowed:** check **Enforce 2FA**, and choose which methods people may use: **Authenticator app**,
**Security keys** and **Email code**. If you stop allowing a method someone uses, they confirm it's them with a method they have at their next sign-in, then set up an allowed one, so nobody is locked out. People you invite set up 2FA before they join.
- **Inactive sessions:** turn on **Close sessions when inactive**, so unattended screens are logged out.
- **IP Whitelist:** add your office or VPN IP addresses. Only people on those addresses can log in; everyone else is blocked.
Click **Save Security Settings** after any change.

#### Use the Login Security Score as your checklist

The **Login Security Score** panel rates your settings out of 100. It checks five protections, worth 20 points each:
- Enforce 2FA for all users.
- Enable password expiration.
- Keep password expiration at 90 days or less.
- Use passwords with at least 12 characters.
- Enable Close sessions when inactive.
Hover over or select an item to find its setting. A score of 100 means all five are on. See [Security Policy](https://dedupe.ly/knowledge-base/security-policy).
**Several CRMs connected?** Each connected CRM has its own Security Policy, users and Audit Log, so set them up in each one. See [Several CRMs in One Dedupely Account](https://dedupe.ly/knowledge-base/several-crms-in-one-dedupely-account).

### Step 4: Know where activity is logged

- **Audit Log:** every action in your account, including merges, scans, changes to Duplicate Searches, user invitations, role changes, logins, logouts, 2FA attempts and security setting changes, with the user and the time. Entries are kept indefinitely, and you can filter by date. Viewing it needs access to the Audit log. See [Audit Log](https://dedupe.ly/knowledge-base/audit-log).
- **Merge History:** every merge, with who ran it, the original records and the values that won. See [Merge History](https://dedupe.ly/knowledge-base/merge-history).

### Step 5: Share the documents your security team needs

- **Certifications:** Dedupely is ISO 27001:2022 certified, including ISO 27017 and ISO 27018.
- **Hosting:** AWS and Google Cloud, North Virginia (USA).
- **AI:** your CRM records are never sent to, processed by or used to train third-party AI models, including in Dedupely Intelligence.
- **CRM connection:** HubSpot, Salesforce and Pipedrive connect through OAuth, with access tokens rotated continuously. Connecting and syncing never change anything in your CRM.
- **Disconnecting:** Dedupely revokes its access where your CRM allows it, and stops syncing.
- **After you cancel:** your data is deleted automatically.
- **Where to find the documents:** the [Trust Center](https://dedupe.ly/trust)
(audits, reports, sub-processors), [Security](https://dedupe.ly/security) and the [Data Processing Addendum](https://dedupe.ly/legal/dpa).
See [Security and Privacy of Your Data](https://dedupe.ly/knowledge-base/security-and-privacy-of-your-data).

### Example setup

A 300-person company with Okta and HubSpot:
- **Sign-in:** SSO with Okta, domain verified, SCIM turned on, and SSO required. Default role for new users: **Read-only User**.
- **Roles:** two Admins in RevOps, three Data Managers, one Accountant in Finance, and a custom "Security reviewer" role for the IT lead.
- **Security Policy:** 2FA enforced with Authenticator app and Security keys only, passwords of 14 characters that expire every 90 days, reuse prevention on, sessions closed when inactive, and the office VPN on the IP whitelist. Login Security Score: 100.
- **Review:** the IT lead checks the Audit Log every quarter for role changes and security setting changes.

### Common mistakes

- **Making everyone an Admin.** Keep Admin to 1–2 people, and give everyone else the role they need.
- **Setting a broad default role for new users.** Everyone SCIM or Google Workspace sync adds gets it. Start with the least access.
- **Enforcing 2FA without telling your team.** People set it up at their next sign-in. Let them know first.
- **Adding an IP whitelist without your VPN.** People working remotely get blocked.
- **Forgetting other connected CRMs.** Each one has its own Security Policy.

### FAQs for IT and security teams

- **Does Dedupely support SSO?** Yes, on every paid plan, through OpenID Connect, with 12 identity providers including Microsoft Entra, Google Workspace and Okta.
- **Does Dedupely support SCIM?** Yes, on every paid plan, with 9 identity providers. Google Workspace sync is also available.
- **Can we require SSO?** Yes. Once it's set up, people can be required to sign in through your identity provider.
- **Which 2FA methods are available?** Authenticator app, security keys and email code, plus backup codes. You choose which ones are allowed.
- **How long is the Audit Log kept?** Indefinitely.
- **Is our CRM data used to train AI?** No. It's never sent to or used to train third-party AI models.
- **Where is our data hosted?** In the AWS and Google Cloud North Virginia (USA) regions.

### Next up

[Single Sign-On and Provisioning Let your team sign in with your identity provider, and add and remove people automatically.](https://dedupe.ly/knowledge-base/single-sign-on-and-provisioning)

### Still stuck?

Our team helps on every plan and during the free trial, by chat, email or Zoom.
- Need help? [Talk to support](https://dedupe.ly/contact)
- Questions about plans? [Book a Zoom with sales](https://meetings.dedupe.ly/meetings/gaby-salinas/kb-zoom-scheduler)
- Reading this with a model? [Read this page as Markdown](https://dedupe.ly/knowledge-base/setting-up-dedupely-for-your-it-and-security-team.md)
- Feeding it the whole site? [Read llms.txt](https://dedupe.ly/llms.txt)
Behind the article

### Gaby Salinas

Marketing Assistant at Dedupely
Gaby Salinas came to CRM data from marketing and advertising, so she looks at duplicates from two sides: the match and merge logic behind them, and what they do to the people using the CRM, like the rep who calls a customer twice, the admin who gets blamed and the cleanup nobody wants to start.
As Marketing Assistant at Dedupely, she follows how RevOps teams, end users, consultants and technical teams actually work with their data: the records they stop trusting, the workarounds they build and the moment they finally decide to clean up. What she finds shapes most of what Dedupely publishes.
[Connect with Gaby on LinkedIn](https://www.linkedin.com/in/gbyslns)

### Get started for free

20 free trial merges and as much free support as you need to get your duplicates under control.
[Try for free](https://v2.app.dedupe.ly/signup)[Talk to sales](https://meetings.dedupe.ly/meetings/gaby-salinas/talk-to-sales)
[Or sign up with Google](https://v2.app.dedupe.ly/signup/google)
Running CRM cleanup for clients? [See the Partner Program](https://dedupe.ly/become-a-partner)