Security overview

Every control that protects your workspace and its data, in one place: sign-in, two-factor, SSO, SCIM, IP allowlist, API tokens, access, audit and data rights.

This page gathers every control that protects your workspace: how people sign in, who can reach the workspace and from where, what each person can see, what is recorded, and how personal data can be exported, erased or expire. Each section points to where the setting lives.

Each person manages their own account in Settings → Security:

Change password: new passwords must be at least 8 characters.
Enable two-factor authentication: after your password, sign-in asks for a code from an authenticator app (Google Authenticator, Authy, 1Password and the like). You get backup codes when you turn it on; Regenerate backup codes replaces them, and Disable turns it off. Both ask you to confirm who you are first.
Active sessions lists the devices signed in to your account, with their address and when they were last active. Sign out any one of them, or all the others at once.

Owners and Admins can turn on Require for everyone in Settings → Security. Every member then needs two-factor authentication: anyone without it sees a Set up two-factor authentication screen and can do nothing else until they set it up, and nobody can turn theirs off while it is required. It can only be switched on by someone who already has two-factor on their own account. API tokens are not affected.

Single sign-on and provisioning

In Settings → Single sign-on (available on plans that include Single sign-on; Owners and Admins), you can:

Let members sign in through your identity provider with SAML or OpenID Connect, and optionally create accounts on first sign-in.
Turn on Provisioning (SCIM 2.0), so your identity provider adds, updates and deactivates members itself.
Turn on a separate directory sync for requesters, which keeps their details and groupings in step and uses no seats.

Full setup is in Single sign-on.

Requesters (your workspace may call them customers or employees) do not have passwords. On the portal's sign-in page they enter their email address and receive a private link to their requests. With an OpenID Connect connection and its option to let requesters sign in to the portal switched on, the page also offers Sign in with your company account. See Customer portal.

IP allowlist

The IP allowlist card, at the bottom of Settings → Single sign-on, limits which networks can use the workspace: the web app, the mobile apps, live updates and API tokens alike. Enter one address or CIDR range per line (for example 203.0.113.0/24); leave it empty to allow any network. The card shows the address you are connecting from, and a list that would shut you out is refused. The requester portal and Help Center stay public.

API tokens

Integrations reach the API with tokens created in Settings → API tokens (available on plans that include API access; Owners and Admins). A token is shown once, when it is created, so copy it straight away; delete it from the list to revoke it. See API.

Who can see what

Roles decide what each member can do. Built-in roles include Owner, Admin, Member, Approver, Auditor (read-only everywhere) and Guest; see Roles.
Private projects: a project created as Private is visible only to the people on its team and to Owners and Admins, including its tickets, docs and files. See Projects.
Guests are invited with the Guest role and a list of projects. A guest sees only those projects, not the rest of the workspace.
Docs pages can be Internal, Private (chosen people) or Public. See Docs.

Audit log

Sign-ins, invitations, role changes, token and allowlist changes and other sensitive events are recorded in Administration → Audit log (available on plans that include Audit logs). See Audit log.

Personal data and retention

A requester's data: on a requester's page, Export data downloads everything held about them as a file, and Erase data scrubs their personal details while keeping their tickets. Both are recorded in the audit log. See Requesters.
Your own account: Settings → Security → Danger zone → Delete account deletes it — type DELETE and enter your password. It is refused while you are the only owner of a workspace that still has other members. An admin can also deactivate or remove a member in Members. See Your account.
Data retention: rules in Settings → Data retention remove old data automatically. See Data retention.

AI and your data

AI features are off until an admin turns them on, one by one, and only send what each feature needs. See AI assist for exactly what is sent.