Security overview

Every control that protects your account and workspace, and where to find it.

This page gathers every security control in one place: what protects each person's account, what an admin can enforce for the workspace, and how access to projects and data is limited.

Two-factor authentication

Each person can turn on two-factor authentication for their own account in Settings → Security: choose Enable two-factor authentication, scan the code with an authenticator app (or enter the key by hand), type the six-digit code, and save the ten backup codes somewhere safe.

Sign-in then asks for a code. A backup code works once each when your phone is not to hand.
Regenerate backup codes replaces them; the old ones stop working.
Disable turns it off after you confirm with your password or a code.
Members who use single sign-on are still asked for their code if they have two-factor turned on.

Two-factor authentication is a personal setting. A workspace cannot currently require it of its members.

Single sign-on

Settings → Single sign-on lets members sign in through your identity provider, using either SAML 2.0 or OpenID Connect. It can create accounts on first sign-in, and turning it on never disables password sign-in. Available on plans that include Single Sign-On; managed by Owners and Admins.

SCIM provisioning

On the same page, Provisioning (SCIM 2.0) lets your identity provider add people when they are assigned the app, update their names, and deactivate or remove them when they leave. Choose Create token, copy the token (it is shown once) and the SCIM base URL into your provider. New people join as Members; roles stay yours to set. Users are synced, groups are not. Revoke stops provisioning; people already provisioned stay.

IP allowlist

Also on the single sign-on page, the IP allowlist limits which networks can use the workspace — browsers, the mobile apps, live updates and API tokens alike. Enter one address or CIDR range per line and choose Save allowlist; leave it empty to allow any network.

The card shows the address you are connecting from, with Add it to include it.
A list that would lock you out is refused, so you cannot shut yourself out by mistake.
Shared docs, the public roadmap and public forms stay public.

API tokens

API tokens (Settings → API tokens) let scripts use the REST API. Each starts withfk_live_ and is shown once, when it is created — only a hash is stored, so a lost token cannot be shown again; create a new one instead. Available on plans that include API Access; managed by Owners and Admins. The IP allowlist applies to tokens too.

Private projects and guests

In a project's Settings → Access, choose Private: only invited members and workspace admins can see it and its issues. Public projects are open to every member.
Invite people from outside your company with the Guest role. You choose their projects when inviting them, and they see only those — not the rest of the workspace, its people directory, chat, reports or settings.
Roles decide what each person may do; see members and roles.

Sessions

Settings → Security → Active sessions lists every device signed in to your account, with its browser, address and when it was last active. Sign out one device, or all the others at once. Changing your password signs out your other sessions too.

Audit log

Sign-ins, invitations and changes to records are recorded with who made them. See them in Settings → Audit log, available on plans that include Audit Logs.

Exporting and deleting data

Settings → Export data downloads the whole workspace as one JSON file. Passwords, two-factor secrets, connection credentials and share links are never included, and each export is recorded in the audit log. Owners and Admins only.
Settings → Data retention archives or deletes closed issues automatically after a set time.
To delete your own account, use Delete account in the mobile app, or follow the steps on the Delete your account page. It cannot be done from the web app's settings.