Security
How sign-in, sessions and workspace access protect your account, and what to do if something looks wrong.
mgmtOS for Artists and mgmtOS for Labels have no passwords of their own. mgmtOS for Artists uses Google sign-in, and mgmtOS for Labels uses Google or Microsoft. SetPlan offers Google or a code sent to your email. Each product signs you in separately; see Accounts and sign-in.
Because sign-in runs through your Google or Microsoft account, or through codes sent to your email, the security of that account or mailbox protects your mgmtOS account too. The terms of use make you responsible for keeping the account you sign in with secure.
mgmtOS for Artists emails you after each sign-in to your account, with the device, IP address and time. If it was not you, follow the steps below.
Open Settings, then Security in mgmtOS for Artists or Security & access in mgmtOS for Labels. The list shows where you are signed in. Choose Revoke next to a session you do not recognize, or Revoke all to end every other session. In SetPlan, use Devices in Account settings; see Sign out of other devices.
In every product, a session ends after 30 days without activity, and at the latest 90 days after sign-in.
Access inside a workspace comes from roles and invitations. In mgmtOS for Artists, a teammate can be limited to the artists they work on. In mgmtOS for Labels, see Members, roles, and artist access. In SetPlan, see Invite people and set roles. Remove people who no longer need access and revoke invitations nobody will accept.
If you connect an assistant or another service, review the access it asks for before you approve it. Revoking the connection stops future access but does not remove information that service already received. For mgmtOS for Labels, see Manage the connection.
The privacy policies describe these measures:
Traffic between your devices and mgmtOS is encrypted in transit, and stored data is encrypted at rest.
In mgmtOS for Artists and mgmtOS for Labels, the most sensitive fields, such as fees, deposits, expenses, taxes, commissions, financial notes and links to private materials, are also encrypted by the application before they are stored, with keys kept separately from the stored data.
Access inside a workspace is limited according to each person's role and permissions.
The policies also note that no service can guarantee absolute security, and that mgmtOS notifies you and the authorities of a breach where the law requires.
Secure the Google or Microsoft account or the mailbox you sign in with.
In each mgmtOS product you use, open the sessions list and end all other sessions.
If you are a workspace owner or administrator, check members and pending invitations.
Tell mgmtOS at info@mgmtos.io. The terms of use ask you to report suspected unauthorized use promptly.
Describe what you found and how to reproduce it in an email to info@mgmtos.io. The terms of use do not allow probing, scanning or testing the services for vulnerabilities, or trying to break security or authentication.
Never send passwords, email codes, session cookies, API keys or full payment details by email, chat or report, including to mgmtOS Support.