PIPA compliance on Admin session timeout

1. Business Context & Compliance Requirements

Under South Korea’s Personal Information Protection Act (PIPA), administrators who process personal information (PI) must have their active sessions automatically terminated after a maximum of 2 hours of inactivity/active access to prevent unauthorized access.

Currently, we configure session limits through our IdP (Okta). However, while Okta handles initial authentication timeouts, active administrative sessions (such as Super Admin or Setup Admin) inside Moveworks remain accessible as long as the browser tab remains open.

Because PIPA mandates application-level session invalidation for administrative consoles with access to PI, relying solely on IdP-level policies does not fully satisfy Korean regulatory requirements.

2. Request Details

To ensure continuous compliance and satisfy regulatory standards, we request the following:

• Native Role-Based Session Timeout: The ability to configure a maximum session lifetime (specifically 2 hours or customizable per role) directly within Moveworks' Roles and Permissions (RBAC) settings.

• Formal Roadmap Addition: We understand this capability is not currently on the immediate product roadmap. However, we urgently request that product management evaluate this requirement and include it in the official product roadmap. Having formal confirmation that this feature is on the roadmap is critical for us to demonstrate proactive remediation and risk mitigation to our compliance auditors.

3. Immediate Action Requested

Could you please help us with:

1. Routing this enhancement request to the relevant Product Management team.

2. Confirming whether this can be tracked as an active feature request / roadmap item.

3. Sharing any available tracking ID, target timeline, or official confirmation that we can present to our audit committee.