Admin > Settings > General Settings (page heading System Settings) holds the platform-wide options: site details, notification switches, the password policy for the passwords people choose and for the temporary passwords the server makes, multi-factor authentication, session timeout, login lockout, integration provider names, a settings backup tool and audit log retention. It is a Super Admin screen.
General Settings
Site Name, Site URL, Timezone (Africa/Johannesburg or UTC) and Currency (ZAR, USD or EUR). Site URL is validated: it must be a well-formed http or https address, otherwise saving is blocked with Please fix validation errors before saving.
Notification Settings
Three switches — Enable Email Notifications, Enable SMS Notifications and Enable Push Notifications — plus an Admin Email (required, must be a valid address) and a comma-separated CC Emails list for additional recipients.
Password Policy
Three fields: Password Expiry (days), Min Password Length (6 to 30) and Require Special Characters in Passwords.
Nobody types a password for someone else, so there is no administrator-typed password for this policy to check. When an administrator adds a person, singly, in bulk or with a new organisation, the server makes a temporary password itself: at least 16 characters, or your minimum length when that is higher, always with an uppercase letter, a lowercase letter, a number and a special character. The person is e-mailed a link to choose their own password; when e-mail is not set up, the welcome cannot be sent, or the account is created switched off, the administrator is shown the temporary password to hand over, and it must be changed at first sign-in.
The policy is checked when people choose their own password: when they register, when they change it on the change-password screen or their profile, and when they choose one through an e-mailed link. A password that fails is refused with the specific reason, for example Password must be at least 8 characters long. On top of your minimum length and the optional special-character rule, the check always requires at least one uppercase letter, one lowercase letter and one number — those three are built in and cannot be switched off. Every e-mailed link — the welcome e-mail, an administrator's reset and Forgot password? — opens TravelFlow's own set-password page, which lists these rules and applies them before the password is set. When the rules cannot be read, that page sets no password and asks the person to try again.
The sign-in service itself holds the same rules, so a password that breaks them is refused wherever it is set, not only on these screens. Saving the policy here updates the sign-in service too; if it cannot be updated, nothing is saved and the page says so. If the sign-in service takes the policy but TravelFlow then reports that it could not save it, TravelFlow reads its saved rules again first: when TravelFlow already holds the rules asked for, because the save was made after all or because they were its rules already, the sign-in service keeps them and the page says the policy is saved. Otherwise the sign-in service is given back the rules it held, and TravelFlow reads its saved rules once more, since the save can still be made meanwhile. Unless both are confirmed as they were, the page says the two may now differ, and saving the policy again makes them match. Existing passwords keep working until they are next changed, when the expiry asks for one.
Password expiry is compared against the date the user last changed their password. If no such date is recorded on the account, the password is treated as not expired.
Multi-Factor Authentication
The Multi-Factor Authentication card has an Enable MFA switch. When it is on you also get:
- Enforcement Mode — Required — Users must set up MFA or Optional — Users can skip MFA setup.
- Grace Period (days) before MFA becomes mandatory (0 means immediately), and a Reminder Period (days).
- Exempt Roles (no MFA required) — tick any of the eight roles.
- Force MFA for Specific Users — search by name or email; these users must have MFA even if it is globally off.
- Remove MFA from User — search the MFA-enrolled users and click Remove MFA. This is what you use when someone loses their phone.
Click Save MFA Settings on that card when you are done. Each save records the settings you changed, before and after, in the audit log.
Session Timeout
Idle Timeout (minutes) (5 to 480; 30 until one is saved) auto-logs a user out after that much inactivity. Warning Duration (seconds) (10 to 120; 60 until saved) controls how long the warning dialog shows first. Cross-tab activity sync makes activity in one browser tab reset the timeout in all tabs. Save with Save Timeout Settings; every save is recorded in the audit log. An organisation admin can set a shorter idle time for their own organisation, never a longer one. Separately, every sign-in ends 12 hours after it was made; that limit is fixed.
Login Security and Clearing a Lockout
The Login Security card sets Max Login Attempts (3 to 20), Lockout Duration (min) (1 to 60) and Attempt Window (min) (5 to 120). The card restates the effect underneath in plain language. Until a super admin saves these settings, sign-in runs on the built-in thresholds: 5 failed attempts within 60 minutes lock the account for 15 minutes. The same built-in thresholds apply if the saved settings cannot be read.
Below that, Locked Out Users lists anyone currently locked, with their attempt count and the time the lock expires. Click Unlock next to a user to clear it immediately, or Refresh to re-read the list. If the list cannot be read, the card says so in red rather than showing an empty list. Save the numeric settings with Save Security Settings; the new values are refused unless they are whole numbers within the ranges above. Every save and every unlock is recorded in the audit log, and the app offers no other way to change these settings.
The record of failed attempts behind a lock, with the IP addresses they came from, is deleted by the daily clean-up 90 days after the last attempt.
Integrations
The sidebar has four free-text boxes: Payment Gateway, GDS Provider, SMS Provider and Email Provider. Each shows a Configured or Not Set badge depending on whether the box has a value. These record which provider is in use; API keys and credentials are not entered here.
Settings Backup
Create Backup Snapshot saves a copy of the current settings and records the time and who made it. The last ten snapshots are listed under Backup History, each with a Restore button that overwrites the current settings after a confirmation prompt. As the card itself notes, this is a snapshot of settings only — it is not a database export.
Audit Log Retention
Set a Retention Period (days) between 30 and 3650; the default is 365. Apart from sign-in and sign-out entries, which the daily clean-up deletes after one year, cleanup is not automatic. Click Purge Old Logs and confirm to permanently delete audit logs older than the saved retention period: save a changed period first. A period outside 30 to 3650 days is refused before anything is saved, and a changed period is recorded in the audit log, before and after. The result tells you how many were removed, or that none were old enough, and the purge is itself recorded in the audit log. This cannot be undone.