Skip to main content
Good security balances friction for attackers without blocking legitimate work. Understand how people authenticate, how long sessions last, and what admins can require before high-risk actions.

​
Authentication options

  • Email and password with optional MFA
  • SAML SSO on eligible plans
  • IdP-initiated login where supported

​
MFA

Require MFA for every member when your data classification demands it—not only admins. Attackers target contributors with broad file access too.

​
SSO cutover

Plan a maintenance window when enabling SAML: communicate downtime, validate attribute mapping with a pilot group, and keep a break-glass local admin.

​
Sessions

Sessions expire after a period of inactivity. Admins can require re-authentication for sensitive actions. Shorter sessions reduce risk on shared machines; longer sessions reduce nagging on trusted laptops.

​
Device hygiene

Encourage disk encryption and screen locks on machines that hold session cookies. Remote wipe policies complement session timeouts for lost hardware.

​
Best practices

Enforce MFA for all admins, use separate staging and production workspaces, and review connected OAuth apps quarterly.

​
OAuth review

Remove tokens for tools you no longer use—old integrations keep API access until revoked. Pair reviews with offboarding checklists when people change roles.