Sign-in, single sign-on and the audit log

This page covers how you sign in to Reeltopus, single sign-on for teams, the audit log, and how to report a security problem. For the controls behind the scenes, see our security page.

Ways to sign in

• Email sign-in link: enter your email on the sign-in page and press Email me a sign-in link. The link works once, for 15 minutes. There's no password to remember or leak.
• Continue with Google, if it's shown on the sign-in page.
• Single sign-on, if your company has set it up. Enter your work email and you're sent to your company's sign-in page.

Signing in for the first time creates your account.

Single sign-on and directory sync (Agency plan)

On the Agency plan, owners and admins can set up single sign-on (SAML 2.0 or OIDC) and directory sync (SCIM) themselves, at /app/settings/sso, with no sales call. It works with Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud and any SAML 2.0 or OIDC identity provider. If your workspace has it, the setup has four steps:

1. Add your email domains. Each one is verified with a DNS record, so only you can claim it.
2. Connect your identity provider. Your IT admin finishes this on a guided setup page. You don't share any secrets with us.
3. Sync your directory (optional). People added in your identity provider join the workspace. People deactivated there are removed at once, along with their API keys and connected apps.
4. Roles and enforcement. Pick the role for people who join through SSO, map directory groups to roles (for example "Video team = editor"), and optionally turn on Require SSO for verified domains. When you require it, existing sessions for those addresses are signed out, and those people sign in with SSO from then on.

Client workspaces are covered by the agency workspace's SSO. If the SSO page says single sign-on isn't switched on yet, write to hello@reeltopus.com.

Audit log

Owners and admins can see the Audit log at /app/settings/audit. It records sign-ins, invites and role changes, API keys, connected apps, webhooks, connected accounts, posts, exports, deletions, billing changes and SSO changes. Each entry shows:

• when it happened (in UTC)
• who did it: a member, an API key or an app
• what they did
• whether it came through the app, the API, an AI app (MCP) or the system
• the IP address and browser

Filter by action, person, source and dates, and press Download CSV to export what you see. Entries can't be edited and are kept for 365 days. Developers can also read the log through the API or stream it to a webhook; see API, webhooks and MCP.

Keep your workspace safe

• Give people the lowest role that works for them. See Teams and roles.
• Remove people who leave. Their API keys and connected apps stop working at once.
• Review Connected apps and API keys under Settings, API, and revoke anything you don't use.
• Only owners and admins can create API keys or change the plan.

How we protect your data

Connections to Reeltopus use HTTPS. Tokens for your connected social accounts and webhook signing secrets are encrypted. We keep only fingerprints of API keys and sign-in links. Payments go through Paddle, so we never see card numbers. The security page lists the controls in place today and what we haven't done yet.

Report a security problem

If you've found a vulnerability, email security@reeltopus.com with what you found, the steps to reproduce it, and what an attacker could do with it. The security page explains how we handle reports and our good-faith research rules. Our security.txt has the same contact.

For account problems that aren't vulnerabilities, such as a sign-in link that doesn't arrive, see Contact support.