Skip to main content

Security

Security sets how and where people sign in, and shows the key that encrypts this workspace's stored credentials.

Sign-in​

The Sign-in card sets the workspace sign-in policy. Changes apply to everyone right away. API keys and connected apps are not affected.

  • Require two-step verification: everyone enters a code from an authenticator app when they sign in. Anyone who has not set one up is asked to the next time they sign in.
  • Sign people out after (minutes): the session limit, from 5 minutes to 7 days (10080 minutes). It counts from when a person signed in, not from their last click: 480 minutes is 8 hours.

Select Save. When the change tightens the policy, anyone it affects, including you, is asked to sign in again.

To reset a person's authenticator, use Reset MFA on Members.

IP allowlist​

The IP allowlist card limits sign-in to your network's address ranges. Select Manage, then Add CIDR for each range (an office VPN, for example). Your own address is shown so you can add it first and not lock yourself out. While the list is empty, every address is allowed; the platform team turns enforcement on.

Encryption key​

Encryption key shows how the workspace's data at rest is encrypted. Rotation is done by the platform team: select Request rotation, give a reason, and select Submit request. The request is recorded in the audit log.

Last updated on