Security, 2FA & SSO
Two-factor, your devices, single sign-on and the IP allowlist.
Your own security
Settings → Security is where you change your password, set up two-factor, and see where you're signed in.
- Two-factor enrolment shows a QR code to scan with your authenticator app; the manual key is behind a disclosure if you need it. You are only enrolled once a code you typed has been checked, so an authenticator that was set up wrong cannot lock you out.
- Ten recovery codes are issued with enrolment. Each works once, in the same box as a normal code — Noots tells them apart by their shape, so a mistyped six-digit code never burns one. Save them somewhere that is not the phone.
- Devices groups your sessions by device, with the last sign-in and how many sessions it holds. Revoking clears that whole device, not one session at a time.
Workspace security
Org settings → Security & SSO:
| Control | What it does | Plan |
|---|---|---|
| Require 2FA | Every member must hold a second factor to use the workspace. Enforced on the pages, the API and the actions alike — see below. | Business |
| IP allowlist | Restrict access to known networks. | Business |
| Domain-based join | Let people on your email domain join, with or without approval. | Team |
| SSO / SAML | Sign in through your identity provider. | Enterprise |
| SCIM provisioning | Create and deactivate accounts from your directory. | Enterprise |
Not by a page refusing to draw itself. A member without a second factor is stopped in the request pipeline, so the pages, the API routes and the server actions behind every button are all closed to them until they enrol — and a second factor is demanded on Google and Microsoft sign-in too, not only on the password path. Two exemptions, both deliberate: members on a domain your identity provider enforces (it owns their second factor, and their password path is already shut), and personal API tokens, which are bearer credentials rather than sign-ins.
An admin can only arm the policy once they hold a working second factor. Sessions already signed in are not thrown out — the requirement is checked on every request, so revoking them would only sign out the people who already comply. And everybody gets ten single-use recovery codes at enrolment, which is the way back in when a phone dies.
Data
Org settings → Data & Compliance holds your retention settings and the data-usage consent controls, and Trash holds anything deleted, recoverable until it's purged.