Settings

The Settings page (/admin/settings) gathers the tenant configuration into seven tabs, each linkable directly (/admin/settings/security, for example).

General

The default language (the default for users without a language setting of their own; “System default” inherits the installation setting), the default theme (light or dark) and the retention of export downloads in hours (empty = the system default; the documents in the export area are unaffected by it).

Security (password policy)

Here you set your tenant’s password policy — it overrides the system-wide default:

• Rules: minimum and maximum length, character classes (uppercase letter, lowercase letter, digit, special character required), plus “The user name must not appear in the password” and “Forbid common or trivial passwords”.
• A status banner shows whether the tenant uses a policy of its own or inherits the system-wide default; “Reset to default” removes your own rules again.
• The “Test password” card checks a test password live against the current state of the form — ideal for seeing the effect before saving.

The policy applies when creating users, when changing a password in the profile, and at the enforced first change.

Email delivery

The SMTP configuration for notifications and test emails: server, port, encryption (STARTTLS / SSL/TLS / none), user name and password (leaving it empty keeps the stored password), the sender address and sender name, plus the “Email delivery enabled” switch. The “Test delivery” card sends a test email to any address — save your changes beforehand.

Note

Without an encryption master key on the server, the page warns that the SMTP password would be stored unencrypted — in that case, ask your system administrator to enable encryption.

Directory service (Active Directory)

The Active Directory connection synchronises users (and optionally groups) into your tenant automatically:

• Connection: server, port, domain, LDAPS (SSL/TLS) (without LDAPS the page warns about unencrypted transmission — for test environments only), the service account and password, and the organisational units (base DNs) (one OU per line, OU=Users,DC=example,DC=local for example). “Test connection” reports “Connection successful — n users found.”
• Group mapping: AD group (DN) → tenant group; mapped groups are assigned to synchronised users automatically.
• Group synchronisation: imports AD groups together with their memberships as managed groups (the “AD” badge).
• Schedule: automatic synchronisation at an interval you choose in minutes; “Synchronise now” starts an immediate run.
• History: every run with its status, trigger (manual or scheduled), result (“n created, n updated, n deactivated, …”) and any conflicts.

Synchronised users sign in with their AD password; the name and password are managed by the directory.

Padding & layout

Fine-tuning of the redaction rectangles: vertical padding as a percentage of the word height (plus a pixel minimum) covers ascenders and descenders (g, p, q, y …), and horizontal padding widens the box. It can be set separately for redaction (default 25% / 6 px / 3 px), pseudonymisation (deliberately restrained at 10% / 3 px / 2 px, so that the replacement text stays centred) and the viewer overlay in the browser. “Reset to default” restores the defaults.

Pseudonymisation (markers)

Tenant-wide marking of generated pseudonyms, so that replacements remain recognisable as such and are not confused with genuine values:

• Enable marker plus the marker text (max. 8 characters, default nym).
• Invisible zero-width layer: an additional invisible marker for text channels (Office and text extraction); it is lost with OCR.
• Pseudonym prefix and suffix: visible brackets around the whole pseudonym, {{Max Mustermann}} for example — immediately recognisable and findable by machine; they are removed again during re-identification.

AI assistant

The configuration of the document chat for your tenant: Enable AI assistant, select the provider and the model, and store the API key per provider (stored encrypted, never shown again; an empty field keeps the stored key). Under “Predefined prompts” you maintain tenant-wide quick-selection prompts for the assistant.