16 results found

1. Full System Audit Trail / User Activity Logs should be mandatory

   CSuite would benefit greatly from having a comprehensive system-wide audit trail that logs all user activity across every module and function.

   Recently we discovered grants had been entered using the “Create Spendable” function, but no user log was available to identify who performed the action. Without that information, the only way to determine what happened is to ask staff individually if they made the entry. When you have multiple staff entering grants, this is important. Not only from an operational standpoint, but from a chain of custody one. We have also had issues with profiles being marked inactive and no log showing who inactivated it. It seems like there are many areas where logs are not being generated.

   For organizations that rely on CSuite for financial and grantmaking operations, this presents a significant gap in internal controls and auditability as well as inefficiencies in daily operations.

   Ideally, every action in the system should generate a log entry, including:

   User name

   Date and timestamp

   Module and record affected

   Type of action (create, edit, generate spendable, delete, etc.)

   A system-wide activity log would allow organizations to:

   Maintain proper audit trails

   Strengthen internal controls

   Quickly troubleshoot data discrepancies

   Identify the responsible user without staff-wide inquiries

   Given the financial and compliance responsibilities of organizations using CSuite, comprehensive activity logging should be standard across all system functions.

   CSuite would benefit greatly from having a comprehensive system-wide audit trail that logs all user activity across every module and function.

   Recently we discovered grants had been entered using the “Create Spendable” function, but no user log was available to identify who performed the action. Without that information, the only way to determine what happened is to ask staff individually if they made the entry. When you have multiple staff entering grants, this is important. Not only from an operational standpoint, but from a chain of custody one. We have also had issues with profiles being marked inactive and no… more

   60 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  8 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. Create VIEW ONLY proxy / "login as" permission

   My team finds it incredibly helpful to proxy in / login as a donor to help them navigate the portal. Right now, if you have the proxy in permission, you are able to make grant requests and changes to the constituent's profile and fund. The system log does not mark those actions as the person who proxied in. It marks those actions as though the constituent made the changes. This is critical for audit purposes and creates several security and control issues.

   My request for fixing this issue is to either create a VIEW ONLY option for proxying in as a constituent.

   OR

   Update the system log to be able to identify that an action was done by an employee who proxied in as the constituent.

   My team finds it incredibly helpful to proxy in / login as a donor to help them navigate the portal. Right now, if you have the proxy in permission, you are able to make grant requests and changes to the constituent's profile and fund. The system log does not mark those actions as the person who proxied in. It marks those actions as though the constituent made the changes. This is critical for audit purposes and creates several security and control issues.

   My request for fixing this issue is to either create a VIEW ONLY option for proxying in as… more

   34 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  5 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. All Record of Recurring Grants are Deleted by Fund Advisor in Portal

   We just discovered with the new portal that when a fund advisor clicks "Cancel Recurring Grant", all record of the recurring grant is deleted out of the system. This is WAY too much access for the fund advisor to have. If they accidentally delete it, we can't view logs to see when it occurred or retrieve attached files to the recurring grant.

   Please allow us the ability to turn off certain features in the portal (like cancelling a recurring grant) for fund advisors if we don't want to take the risk of information being deleted without our consent. These types of logs and records are critical support and backup that we provide to our auditors, and without it, we are in a very bad position from documentation for our audit. At the very least, allowing us to "approve" a cancellation would be ideal, as I could see a fund advisor accidentally clicking "Cancel" and it provides no warnings.

   We just discovered with the new portal that when a fund advisor clicks "Cancel Recurring Grant", all record of the recurring grant is deleted out of the system. This is WAY too much access for the fund advisor to have. If they accidentally delete it, we can't view logs to see when it occurred or retrieve attached files to the recurring grant.

   Please allow us the ability to turn off certain features in the portal (like cancelling a recurring grant) for fund advisors if we don't want to take the risk of information being deleted without our consent. These types… more

   98 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. Show Deleted Profiles in the Log

   Have the log show the name, ID and date whenever a profile is deleted. Our admin needs an audit trail of all MAC (move, add, change) activities in the log.

   38 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  1 comment  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. Flexible Multi-Factor Authentication (MFA) Controls

   Problem Statement:
   Currently, the system requires MFA at every login, regardless of the device or session context. While secure, this "one-size-fits-all" approach is causing significant MFA fatigue among users and disrupting workflows on trusted, managed devices.

   Proposed Enhancement:
   I am requesting the implementation of more granular MFA controls that allow for a better balance between security and user experience. Specifically, I propose adding the following features:
   "Remember This Device" Option:
   Allow users to opt-in to a trusted device status (e.g., for 14 or 30 days). This would suppress MFA prompts for subsequent logins on that specific browser/device until the duration expires or the session cookie is cleared.
   Adaptive/Risk-Based MFA:
   Implement logic that triggers MFA only when "out-of-pattern" behaviour is detected, such as:
   Logins from a new IP address or geographic location.
   Accessing the system from an unrecognized device or browser.
   Attempts to perform high-privilege actions (e.g., password changes or data exports).
   Configurable Re-authentication Intervals:
   Provide administrators the ability to set different MFA frequencies based on user roles (e.g., standard users every 7 days vs. admins at every login).

   Benefit:
   These updates will reduce "notification spam," lowering the risk of users reflexively approving malicious MFA requests while maintaining high security for sensitive actions and unknown access points.

   Goal:
   Move from a static "every login" requirement to a dynamic, risk-aware authentication model.

   Problem Statement:
   Currently, the system requires MFA at every login, regardless of the device or session context. While secure, this "one-size-fits-all" approach is causing significant MFA fatigue among users and disrupting workflows on trusted, managed devices.

   Proposed Enhancement:
   I am requesting the implementation of more granular MFA controls that allow for a better balance between security and user experience. Specifically, I propose adding the following features:
   "Remember This Device" Option:
   Allow users to opt-in to a trusted device status (e.g., for 14 or 30 days). This would suppress MFA prompts for subsequent logins on that specific browser/device until the duration… more

   6 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. Expand Special Character Support in CSuite Password Policy

   Problem Statement:
   There is currently a technical conflict between our organization’s security tools and the CSuite platform. We enforce the use of Keeper for all staff to generate and store high-entropy passwords. However, CSuite rejects many of the standard special characters generated by these tools (e.g., ^, *, [, {, |).
   When Keeper generates a secure password, CSuite frequently returns an error, forcing staff to manually change or delete characters that are not allowed or resort to simpler, less secure passwords. This creates a significant friction point and undermines our security posture.

   Proposed Enhancement:
   Update the CSuite password validation logic to support the full range of special characters found on a standard ASCII keyboard.

   Technical Requirements:
   Broaden Character Set: Allow all standard symbols, including: ! @ # $ % ^ & * ( ) _ + - = [ ] { } ; : ' " \ | , . < > / ? ~`
   Validation Alignment: Ensure the backend database and application filters are updated to handle these characters securely (e.g., via proper salting/hashing) to prevent injection risks while allowing user flexibility.

   Benefit:
   Security Compliance: Allows staff to use 100% of the security features in Keeper without manual intervention.
   Improved UX: Eliminates the "trial and error" loop staff currently face when setting or changing passwords.

   Goal:
   To align CSuite’s password policy with industry-standard password managers, ensuring that "strong" passwords generated by our internal tools are accepted without error.

   Problem Statement:
   There is currently a technical conflict between our organization’s security tools and the CSuite platform. We enforce the use of Keeper for all staff to generate and store high-entropy passwords. However, CSuite rejects many of the standard special characters generated by these tools (e.g., ^, *, [, {, |).
   When Keeper generates a secure password, CSuite frequently returns an error, forcing staff to manually change or delete characters that are not allowed or resort to simpler, less secure passwords. This creates a significant friction point and undermines our security posture.

   Proposed Enhancement:
   Update the CSuite password validation logic… more

   5 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

7. Vendor Permissions Separate From Profile Permissions

   Have the vendor area of a profile have different view, edit, delete, etc. permissions form the regular profile so that vendor info can be locked down to control payment information

   13 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. Restrict logging in as other Users to the Admin security group

   The current functionality allows any user with permissions to Login As (UserA) to login as another user (UserB) and act as UserB with UserB's permissions which may be different than UserA's permissions. For example, someone who assists Fund Advisors and has no financial permissions could Login As someone with Accounting group membership and surreptitiously generate and print checks. There is currently a security feature that prevents users who are not in the Admin security group from logging in as a User who is in the Admin group. Could this feature could be expanded so that only Admin users can Login As other profiles with the User designation? Implementing that, and the other IdeaLab suggestions to log when actions are taken by proxy would address this security concern.

   The current functionality allows any user with permissions to Login As (UserA) to login as another user (UserB) and act as UserB with UserB's permissions which may be different than UserA's permissions. For example, someone who assists Fund Advisors and has no financial permissions could Login As someone with Accounting group membership and surreptitiously generate and print checks. There is currently a security feature that prevents users who are not in the Admin security group from logging in as a User who is in the Admin group. Could this feature could be expanded so that only Admin users can Login… more

   2 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. Add the 'Log' Menu item to every screen that has data on it.

   Many screens have the 'Log' menu item, but not all of them. For example, Fund fee type has a 'log' button to see who edited it, but Admin Fee types does not. But if you go into "Logs" and add a few filters, you can create a filter that approximated what the 'log' button would have done for that screen.

   It would be best if all screens that had any sort of editable data on it had a 'log' button on it that would create a filtered log list for that item.

   26 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Proposed Idea  ·  2 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. Separate "Create" and "Link Profiles" in Permissions

    Can you please separate the "Link Profiles" permission from the "Create" permission under Profile Permissions? We don't want some staff to be able to create new profiles, but we want them to be able to link existing profiles to each other under relationships. Thanks so much.

    5 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. Hide UI Elements for Users that Lack Permission

    Please configure the software to hide all UI elements (buttons, menu items, sections) for which the user lacks permission. Only display controls and features that the user is authorized to access.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. Add Proxy Information in System Log when Login As is used - Audit Purposes

    When I login as another CSuite User and then make an update, the system log shows the action was made by the CSuite User, not by me proxied in as the CSuite user. Is there any way for you to record in the system log when an action has been completed by someone else proxied in as the user? We feel this is critical for audit purposes.

    23 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  4 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Profile Permissions: Separate "Manage Login Info" from "Login As"

    As the legacy portal end date nears, we continue to be bothered by the fact that the "Manage Login Info" and the "Login As" permissions are combined for the new portal, especially as it relates to Fund Advisors.

    For our operation, the same people who support fund advisors through the Login As feature are NOT the same people who Edit the fund advisors' login, NOR manage a fund advisor's password (set or change), NOR Link an Organization or Individual to the Fund Advisor.

    We require these permissions to be separated.

    16 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  2 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

14. Create Fund Advisor Login (for Legacy Portal) from "Fund Advisor" record

    Only staff members with full "Manage Login Info/Login As" permissions on the Profile can fully set up a new "Fund Advisor" record through to the "Send Login Email" step.

    Having "Manage Login Info/Login As" means the employee can reset ANY staff member's password - which means they can take over any account in CSuite. This is essentially the MOST critical security authorization available.

    We will not give our fundraising staff this level of access, but it means that all new Fund Advisor setups must run through one of our primary site administrators rather than be managed by our fundraisers.

    There needs to be a separate permission level to create accounts for Non-Employee/Legacy Fund Portal members.

    Only staff members with full "Manage Login Info/Login As" permissions on the Profile can fully set up a new "Fund Advisor" record through to the "Send Login Email" step.

    Having "Manage Login Info/Login As" means the employee can reset ANY staff member's password - which means they can take over any account in CSuite. This is essentially the MOST critical security authorization available.

    We will not give our fundraising staff this level of access, but it means that all new Fund Advisor setups must run through one of our primary site administrators rather than be managed by our fundraisers.

    There… more

    17 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  3 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

15. View Only permission option for Log In As in New Portal

    We would like a 'View Only' permission option for the 'Log In As' function in the new portal. For audit purposes, we can't have multiple people use this feature as it stands. However, it is crucial for our donor/partner engagement teams to be able to support our fund holders and grantees using this feature.

    6 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

16. Follow link after login authentication

    I get lots of emails from Community Suite when someone includes me on a Note, or creates a Voucher for a fund I'm an approver on. Clicking on the link in those emails involves a 3 step process:
    1. Link takes me to the login page for our CS instance.
    2. After logging in successfully, I'm taken to our dashboard.
    3. But what about that original link? I need to go back to email and click it again, to go to the item in question.

    It would be great if, like on many other web applications, after login you were taken directly to the item that brought you to the website initially!!

    I get lots of emails from Community Suite when someone includes me on a Note, or creates a Voucher for a fund I'm an approver on. Clicking on the link in those emails involves a 3 step process:
    1. Link takes me to the login page for our CS instance.
    2. After logging in successfully, I'm taken to our dashboard.
    3. But what about that original link? I need to go back to email and click it again, to go to the item in question.

    It would be great if, like on many other web applications, after login you were… more

    2 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Proposed Idea  ·  0 comments  ·  Permissions/Logs  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating