> For the complete documentation index, see [llms.txt](https://docs.scaleflex.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scaleflex.com/portals/portal-settings/access.md). # Access and security Decide who can open a Portal, and on what terms. A Portal can be open to anyone with the link, or closed to everyone but the people you approve. This is where you choose, on the **Security** page. It holds four cards: | Card | Decides | | ------------------------- | ---------------------------------------------- | | **Access management** | Who can open the Portal, and when. | | **Gallery link security** | Whether gallery links can be tampered with. | | **Privacy** | What may be shared with third-party services. | | **Age verification** | Whether visitors must confirm their age first. | ## Access management *Add an additional level of security to your Portal.* ### Access The first choice, and it decides what the rest of the card offers. **Public** means anyone with the link can open the Portal without signing in. Good for press rooms and brand guidelines — anything you'd be happy to see forwarded. **Private** means visitors must identify themselves. You then decide how they get in: people from your organisation, people you invite, or people who register and are approved.

The Access management card, where a Portal is set public or private.

### On a public Portal One setting appears: | Setting | What it does | | -------------------- | -------------------------------------------------------------------------------------------------------- | | **Require password** | Adds a shared password phrase everyone uses. Tick it and a field appears — *Enter your password phrase*. | A shared password and individual accounts solve different problems. A password is quick and anonymous — you can't tell who used it, or withdraw access from one person. Accounts tell you who came, and can be revoked individually. ### On a private Portal The password disappears and three things take its place: | Setting | What it does | | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | **Allow Hub users and administrators to access the portal** | Lets your own DAM users in without a separate Portal account. | | **Self registration** | Lets visitors request an account themselves, rather than being invited. | | **Require approval** | Holds each registration until someone approves it. Only once **Self registration** is on. | | **Approvers** | Who receives those requests. | | **Notification channel** | Where the approval requests are sent. | **Self registration** without **Require approval** means anyone who finds the link gets in. That's often fine, and occasionally a surprise — worth deciding rather than defaulting. ### Start and expiry dates **Start date** and **Expire at** sit at the bottom of the card, and apply whether the Portal is public or private. Useful for anything with a date attached: a campaign that mustn't go live early, a press embargo, a partner Portal that should close at the end of a contract. Set the expiry when you create the Portal, not when you remember. ### Owner **Owner** names who owns the Portal; **Change owner** hands it to someone else. ## Gallery link security *Protect gallery redirect links from URL tampering.* **Enable gallery link security** stops a visitor editing a link's parameters to reach assets you didn't share. ## Privacy *Configure what data can be shared with external tools.* **Allow usage of external tools** controls what may be sent to third-party services. It's what enables previews of PowerPoint and Excel files — with it off, those are download-only. ## Age verification **Enable age verification page** puts a gate in front of the Portal: visitors give their date of birth before they see anything. It's the drinks-industry requirement, and anything else with a legal age attached. | Setting | What it does | | --------------------------- | ------------------------------------------------- | | **Minimum age** | The age a visitor has to reach to get in. | | **Redirect URL on decline** | Where to send visitors who fail age verification. | Turning it on adds an **Age verification** page to the Portal, which you can then style like any other system page. {% hint style="warning" %} Age verification only applies to a **public** Portal. Switching **Access** to **Private** turns it off — a Portal that already asks visitors to sign in has no anonymous arrival to gate. {% endhint %} ## Saving Changes here raise the **Save** bar at the top of the page; nothing takes effect until you use it. **Cancel** puts the form back as it was. ## Related * [Authentication](/portals/portal-settings/authentication.md): signing in with a Google account. * [Users](/portals/portal-settings/users.md): the people who have access. * [Terms & Conditions](/portals/building-a-portal/pages/system-pages/registration/terms-and-conditions.md): requiring acceptance at registration.