Skip to content
Open Breno

Workspace security

Turn on and require two-factor authentication, manage sessions, set data retention and a legal hold, and what protects connector credentials and AI keys.

Report a problem with this page

These are the controls an administrator has. They live under More, then Settings, then Security.

Two-factor authentication#

Open the Multi-factor authentication section and choose Start setup. Scan the key with an authenticator app (TOTP), enter the six-digit code it shows, and choose Turn on. Breno then shows recovery codes: store them somewhere safe, because they are how you get in if you lose the app.

To turn it off you enter a code from the app, or a recovery code.

Require it for everyone#

Administrators can switch on Require two-factor authentication for the whole workspace. Deleting your account while two-factor is on asks for a code too.

Sessions#

The Security tab lists where you are signed in. You can end any session other than the one you are using. Revoking a session takes effect at once.

Data retention#

Keep chats and history for sets how long search history and conversation records are kept before they are removed.

Switch on Legal hold and deletion pauses until you turn it off: scheduled removal and purges are held, so material relevant to a dispute is not destroyed.

Credentials and keys#

  • Credentials for connected sources and keys for your own AI accounts are encrypted at rest. Production deployments refuse to start without the encryption key set.
  • Keys are never sent back to the browser; only a short hint is shown.
  • A key can be rotated without re-entering every credential: the platform re-seals stored secrets under a new key.

Tokens#

Personal tokens are created and revoked under Connect AI. Revoke any you do not recognize. See Tokens.

Delete the workspace#

An Owner can delete the whole workspace here, by typing its name. See Delete your data.

Checklist#

  1. Require two-factor authentication.
  2. Give people the lowest role that works.
  3. Put sensitive material in spaces and raise its label.
  4. Review connected sources, and connect only what you intend to keep.
  5. Review tokens, and revoke the ones in no use.
  6. Look at the audit log from time to time.