Workspace settings reference
Manage workspace settings: members and roles, security and 2FA enforcement, SSO, billing, API tokens, webhooks, the audit log and white label branding.
Workspace at the foot of the menu opens the workspace's settings. The pages are tabs across the top, and you see only the tabs your permissions allow. Billing, Email reports and Exports are tabs too. Alerts open from the bell beside the search, and the workspace's dashboards from the site switcher.
| Page | What's there | Permission |
|---|---|---|
| General | Name, default timezone and currency, workspace id (ws_…), and Delete workspace |
workspace.manage |
| Members | Members with role, site access, 2FA status and last activity. Invite, change role or site access, remove, transfer ownership. See Teams | members.manage to change |
| Roles | What each built-in role can do and, on Business, custom roles | members.manage to change |
| Security | Require 2FA (Business), allowed login methods, session lifetime, IP allowlist (Business), support access | workspace.manage |
| SSO (Business) | SSO with SAML or OIDC, email domains and SCIM | workspace.manage |
| API tokens | Create, see last use, revoke. See Authentication | Any member for their own tokens, tokens.manage for other members' |
| Webhooks | Endpoints, events, signing secret, delivery log with Resend. See Webhooks | workspace.manage |
| White label (Business) | Brand name, logo and accent color on shared dashboards, embeds and email reports, and an option to hide Privatus Analytics branding | workspace.manage |
| Audit log | Who did what, when. See Audit log | workspace.manage |
| Billing (sidebar) | Plan, usage meter with forecast and per-site breakdown, change plan, payment method, billing emails, tax id, invoices, cancel. See Billing | billing.manage |
Owner and Admin hold all of these permissions. See Roles and permissions.
General#
| Field | What it does |
|---|---|
| Name | The workspace's name, up to 100 characters |
| Default timezone | The timezone a new site starts with. Changing it does not change existing sites |
| Default currency | A three-letter code such as USD. The currency a new site starts with. Changing it does not change existing sites |
| Benchmarks | On by default. Your sites are compared with what is typical across all sites (How you compare), and one number per site counts toward those benchmarks, which never name a site. Off, your sites are left out and the comparisons are hidden |
| Workspace id | The ws_… id used in API paths. It can't be changed |
Save stores the form. Through the API: PATCH /workspaces/<workspace id>
with name, timezone, currency and benchmarks (MCP:
workspaces_update).
Delete workspace#
Only the owner sees this box. Type the workspace's name to confirm.
- A paid subscription is canceled first. If that fails, nothing is deleted.
- The workspace and all its sites stop collecting at once, and pending site transfers are canceled.
- Everything is permanently deleted after 7 days.
Security#
Sign-in rules for every member, saved with one Save button. Workspace security settings explains each rule in detail.
| Setting | Options | What it does |
|---|---|---|
| Require two-factor authentication (Business) | On or off | Members without an authenticator app or a passkey are sent to set one up before they can open the workspace |
| Allowed login methods | Email and password, Email login link, Passkey, Google, GitHub, Apple, SSO (SAML/OIDC) | The ways members may sign in. At least one must stay ticked. The owner can always sign in with a password or a passkey. The mobile app follows the same rules |
| Sign members out after | No limit, 8 hours, 24 hours, 7 days, 30 days | How long a sign-in lasts. A member of several workspaces gets the shortest of their limits |
| IP allowlist (Business) | IP addresses and CIDR ranges, IPv4 or IPv6, one per line | Only these addresses can open the workspace in the app or use its API tokens. Empty allows any address. The list must include your current address, which the page shows |
| Support access | On or off | Lets Privatus Analytics support view the workspace for 7 days from when you save. Clearing it ends the access. Without it, support staff can't see the workspace |
Through the API: GET and PATCH /workspaces/<workspace id>/security
(MCP: workspace_security_get, workspace_security_update). Over MCP
workspace_security_update only returns a link to this page, see
Actions for a person.
SSO#
Business only. On other plans the page shows an upgrade note. The full walkthrough is in Single sign-on.
| Setting | What it does |
|---|---|
| SAML 2.0 or OpenID Connect | The protocol. The form shows only the fields of the one you choose |
| IdP single sign-on URL, IdP entity id (issuer), IdP signing certificate (PEM) | SAML: the values from your identity provider. The page lists the ACS URL and entity id to give it in return |
| Issuer URL, Client id, Client secret | OpenID Connect: the values from your identity provider. The page lists the redirect URI. A saved secret is never shown again. Leave the field empty to keep it |
| Email domains | People with these email domains can use "Log in with SSO". Empty allows any email your identity provider sends |
| Create members on their first SSO login | Adds a person as a member the first time they sign in through SSO |
| Role for new members | Admin, Editor, Analyst, Viewer or Billing |
| Enforce SSO | Members must sign in through your identity provider. The owner keeps password access. It can be ticked only once the configuration is active |
Below the form, Test SSO login tries the configuration, Activate turns it on after a successful test, and Turn off switches SSO off. The status line shows Draft, Testing, Tested or Active.
SCIM provisioning lets your identity provider add and remove members. Generate SCIM token shows the token once. Generating a new one stops the old one. See SCIM.
White label#
Business and up, and any paid plan of an approved agency. On other plans the fields are disabled. See White label.
| Field | What it does |
|---|---|
| Brand name | Your name, up to 60 characters, shown on shared dashboards, embeds and email reports for every site in the workspace |
| Logo URL | An https link to a PNG, SVG or JPEG, shown about 32 pixels tall |
| Accent color | A six-digit hex color such as #06755b |
| Hide Privatus Analytics branding | Removes the Privatus Analytics name and logo from shared dashboards and email reports |
Custom dashboard domains and custom email sender domains are not
available. Shared dashboards use the Privatus Analytics address. Through
the API: GET and PATCH /workspaces/<workspace id>/white_label (MCP:
white_label_get, white_label_update).
Legal documents#
The DPA (which incorporates the EU Standard Contractual Clauses) and the subprocessor list are on the legal pages. See Privacy & compliance.