Why identity matters on a feedback board
Every post, vote and comment in Looph belongs to a signed-in account. That is what makes one vote per person possible, what lets Looph tell people when a request they backed changes status or ships, and what lets you ban someone who abuses the board.
The cost is a sign-in step for the customer, so Looph keeps it short: a visitor can read a public board without an account, and is only asked to sign in when they post, vote or comment. If they click vote while signed out, the vote is cast as soon as they return.
How people sign in
Customers and your team use the same sign-in: an email address and password, or a Google account. People can add two-factor authentication to their account from their profile settings, and can see and end their active sessions there too.
Your team are workspace members with a role; customers are simply people with an account who take part on your boards. Nobody needs a separate login per workspace.
- 1Open your board and choose to sign in, or click vote or post.
- 2Continue with Google, or enter an email address and password.
- 3Return to the board, where any vote you clicked has been cast.
Setting up two-factor authentication
Two-factor authentication in Looph uses an authenticator app, such as Google Authenticator, 1Password or Authy. Anyone can turn it on for their own account, whether they are on your team or a customer. If you lose the device, a backup code gets you in; each code works once. On an account where backup codes are not available, setup says so, and the authenticator is your only second factor.
The Sessions tab in the same place lists every device signed in to your account. You can sign out of one device, or choose Sign out of all other devices.
- 1Open your profile settings and choose the Security tab.
- 2Under Two-factor authentication, choose Set up two-factor.
- 3Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown under it instead.
- 4Enter the six-digit code the app shows, and choose Verify.
- 5Save the backup codes somewhere safe. They are shown only once. Tick I've saved these backup codes to finish.
Custom domains
If your board runs on your own domain, such as feedback.yourdomain.com, sign-in carries over to it. On a person's first visit, the page makes one quick trip through Looph and back; if they are signed in to Looph, they return signed in on your domain without doing anything. If they are not signed in, Looph does not try again for ten minutes unless they reload the page.
That trip is skipped when the browser blocks cookies or the board is shown inside a frame on another site. People in those cases sign in by choosing to sign in, vote or post, as anywhere else. Signing out on your domain ends the session on that domain only; the person stays signed in to Looph and to other boards.
Your team's roles
Every teammate has one of three fixed roles: owner, admin or member. Owners and admins run the workspace; members take part as your team without managing settings. Invite people from Settings, then Members.
Security controls for the owner
The owner manages three controls in Settings, then Security. Require two-factor for admins and Allowed sign-up domains come with Growth and Business; the Admin IP allowlist comes with Business. Admins can't change these settings, and the owner is never blocked by them, so a workspace can't lock itself out of its own admin.
With Require two-factor for admins on, an admin without a second factor is stopped at a Two-factor authentication required screen and can't take admin actions until they choose Set up authenticator app and finish it. An admin who later removes two-factor is asked to set it up again on their next admin action.
Allowed sign-up domains limits who can be invited to the workspace. Enter up to 50 domains, such as acme.com; each must match the part of the email address after the @ exactly, so acme.com does not cover eu.acme.com. Looph checks the list when an invite is created, and refuses others with Email domain not allowed. Existing members and invite links already sent are not affected, and customers who sign in to post or vote are not restricted by it.
The Admin IP allowlist limits admin actions to up to 50 IP addresses or CIDR ranges, in IPv4 or IPv6, such as 203.0.113.0/24 or 2001:db8::/32. A single IPv6 address is saved as its /64 range, because the end of an IPv6 address changes every few hours. The page shows your current IP and offers to add it. The list covers the admin area only: API keys, webhooks and your public boards are not affected. An admin outside the list is told that the workspace only allows admin actions from approved networks.
After a downgrade, a saved control is kept but not applied, and the page marks it as saved but not applied. It applies again when you upgrade, or you can clear it.
Plans
Sign-in is the same on every plan: email and password, or Google. No plan includes single sign-on, SAML or SCIM today. Growth and Business let the owner require two-factor authentication for admins and limit team invites to allowed email domains, and Business adds an admin IP allowlist.
Coming soon
Single sign-on for your own team through a SAML or OIDC identity provider, such as Okta or Entra ID, is coming soon, along with SCIM provisioning to keep membership in step with your directory and custom roles beyond owner, admin and member.
Identifying your own signed-in customers is also coming soon: your server will sign a token with the person's details and, optionally, their company, plan and spend, so they are recognised on your board without a second sign-in. Today, customers sign in to Looph directly as described above. Seeing the company, plan and MRR behind each vote already works through the Segment integration on Growth and Business.
Keeping customer data tidy
Ask customers for nothing beyond what sign-in needs. Looph records a name and email address with each account, which is enough to notify people and to tell your team who asked for what.
When a customer asks to be forgotten, an admin can export or erase that person's data from Settings, then Data, and people can download or delete their own account from their profile.