Restrict when and where your team can connect

An organisation access policy lets you decide the conditions under which members can use Reach at all: which countries they can connect from, which IP ranges, which hours of the day, and whether the device must be one Reach already trusts. It's enforced at the gateway on every connection, so a member outside the policy genuinely can't route traffic — they don't just fail an app login.

Where to set it

In your admin dashboard open the organisation, go to the Gateways tab, and tick Access policy. Fill in the constraints you want, then click Save Gateway Settings. Leave any constraint empty to not use it.

SettingWhat it doesNotes
Allowed countriesOnly connections from these countries are acceptedISO codes, e.g. AU, NZ. Empty = no country restriction.
Allowed IP rangesOnly connections from these CIDR ranges are acceptede.g. 203.0.113.0/24 for an office line. Empty = no IP restriction.
Restrict to office hoursOnly connections inside the window are acceptedPick days (Mon–Sun), a from/to time and a timezone such as Australia/Sydney. Defaults to Mon–Fri 09:00–17:00.
Require a trusted deviceOnly devices Reach already knows for that member are acceptedSee Members & devices for how a device becomes trusted.

Every constraint you fill in must be satisfied — a member connecting from an allowed country but outside office hours is still blocked.

How it's enforced

The gateway evaluates the policy per connection, not once at sign-in:

  • Country comes from the connection's source address as seen by the gateway's edge network.
  • IP range is checked against the member's real public IP.
  • Office hours are evaluated in the timezone you set, with days numbered Monday to Sunday and the window inclusive of both times.
  • Trusted device compares the identifier the client presents with the member's list of trusted devices.

A blocked connection is refused at the gateway with a reason — region, network, hours or device. The mobile apps show a banner when access is restricted; on desktop the routed apps can't reach the gateway until the member is back inside the policy.

Members who belong to more than one organisation

If a member is in several organisations with enabled policies, the strictest rule from every policy applies:

  • their country must be in every organisation's allowed list;
  • their IP must fall inside a range from every organisation that sets ranges;
  • the time must be inside office hours for every organisation that sets hours;
  • a trusted device is required if any organisation requires one.

A lax or disabled policy in one organisation can never loosen a strict policy in another.

Access policy vs IP access rules

Reach also has per-account IP access rules — allow and deny lists that decide which destinations a member may reach through the gateway (see IP allowlisting & cloud firewall). The access policy on this page is about the member's own location, time and device. They're independent and can be combined.

Common questions

Does the policy apply to the organisation owner?

Yes — it applies to everyone whose Reach key belongs to the organisation, including the owner. Test a new policy from an allowed location before tightening it.

What happens to an active session when office hours end?

New connections are refused once the window closes. Because the policy is checked per connection, an already-open stream isn't cut mid-transfer, but the next request from that app is blocked.

Can I allow a member to work from overseas temporarily?

Add the country (or their IP range) to the policy for the trip, then remove it. There's no per-member exception yet; a member who needs a permanently different policy is best placed in a separate organisation.