Workspace settings reference

Manage workspace settings: members and roles, security and 2FA enforcement, SSO, billing, API tokens, webhooks, the audit log and white label branding.

# Workspace settings reference

> Manage workspace settings: members and roles, security and 2FA enforcement, SSO, billing, API tokens, webhooks, the audit log and white label branding.

**Workspace** at the foot of the menu opens the workspace's settings. The
pages are tabs across the top, and you see only the tabs your permissions
allow. **Billing**, **Email reports** and **Exports** are tabs too. Alerts
open from the bell beside the search, and the workspace's dashboards from
the site switcher.

| Page | What's there | Permission |
|---|---|---|
| [**General**](/docs/dashboard/workspace-settings#general) | Name, default timezone and currency, workspace id (`ws_…`), and **Delete workspace** | `workspace.manage` |
| **Members** | Members with role, site access, 2FA status and last activity. Invite, change role or site access, remove, transfer ownership. See [Teams](/docs/teams) | `members.manage` to change |
| **Roles** | What each built-in role can do and, on Business, [custom roles](/docs/teams/roles#custom-roles) | `members.manage` to change |
| [**Security**](/docs/dashboard/workspace-settings#security) | Require 2FA (Business), allowed login methods, session lifetime, IP allowlist (Business), support access | `workspace.manage` |
| [**SSO**](/docs/dashboard/workspace-settings#sso) (Business) | [SSO](/docs/teams/sso) with SAML or OIDC, email domains and [SCIM](/docs/teams/scim) | `workspace.manage` |
| **API tokens** | Create, see last use, revoke. See [Authentication](/docs/api/authentication) | Any member for their own tokens, `tokens.manage` for other members' |
| **Webhooks** | Endpoints, events, signing secret, delivery log with **Resend**. See [Webhooks](/docs/api/webhooks) | `workspace.manage` |
| [**White label**](/docs/dashboard/workspace-settings#white-label) (Business) | Brand name, logo and accent color on shared dashboards, embeds and email reports, and an option to hide Privatus Analytics branding | `workspace.manage` |
| **Audit log** | Who did what, when. See [Audit log](/docs/teams/audit-log) | `workspace.manage` |
| **Billing** (sidebar) | Plan, usage meter with forecast and per-site breakdown, change plan, payment method, billing emails, tax id, invoices, cancel. See [Billing](/docs/billing) | `billing.manage` |

Owner and Admin hold all of these permissions. See
[Roles and permissions](/docs/teams/roles).

## General

| Field | What it does |
|---|---|
| **Name** | The workspace's name, up to 100 characters |
| **Default timezone** | The timezone a new site starts with. Changing it does not change existing sites |
| **Default currency** | A three-letter code such as `USD`. The currency a new site starts with. Changing it does not change existing sites |
| **Benchmarks** | On by default. Your sites are compared with what is typical across all sites ([How you compare](/docs/dashboard/insights#how-you-compare)), and one number per site counts toward those benchmarks, which never name a site. Off, your sites are left out and the comparisons are hidden |
| **Workspace id** | The `ws_…` id used in API paths. It can't be changed |

**Save** stores the form. Through the API: `PATCH /workspaces/<workspace id>`
with `name`, `timezone`, `currency` and `benchmarks` (MCP:
`workspaces_update`).

### Delete workspace

Only the owner sees this box. Type the workspace's name to confirm.

- A paid subscription is canceled first. If that fails, nothing is
  deleted.
- The workspace and all its sites stop collecting at once, and pending
  site transfers are canceled.
- Everything is permanently deleted after 7 days.

## Security

Sign-in rules for every member, saved with one **Save** button.
[Workspace security settings](/docs/teams#workspace-security-settings)
explains each rule in detail.

| Setting | Options | What it does |
|---|---|---|
| **Require two-factor authentication** (Business) | On or off | Members without an authenticator app or a passkey are sent to set one up before they can open the workspace |
| **Allowed login methods** | Email and password, Email login link, Passkey, Google, GitHub, Apple, SSO (SAML/OIDC) | The ways members may sign in. At least one must stay ticked. The owner can always sign in with a password or a passkey. The [mobile app](/docs/dashboard/mobile-app#which-workspaces-appear) follows the same rules |
| **Sign members out after** | No limit, 8 hours, 24 hours, 7 days, 30 days | How long a sign-in lasts. A member of several workspaces gets the shortest of their limits |
| **IP allowlist** (Business) | IP addresses and CIDR ranges, IPv4 or IPv6, one per line | Only these addresses can open the workspace in the app or use its API tokens. Empty allows any address. The list must include your current address, which the page shows |
| **Support access** | On or off | Lets Privatus Analytics support view the workspace for 7 days from when you save. Clearing it ends the access. Without it, support staff can't see the workspace |

Through the API: `GET` and `PATCH /workspaces/<workspace id>/security`
(MCP: `workspace_security_get`, `workspace_security_update`). Over MCP
`workspace_security_update` only returns a link to this page, see
[Actions for a person](/docs/mcp#actions-for-a-person).

## SSO

Business only. On other plans the page shows an upgrade note. The full
walkthrough is in [Single sign-on](/docs/teams/sso).

| Setting | What it does |
|---|---|
| **SAML 2.0** or **OpenID Connect** | The protocol. The form shows only the fields of the one you choose |
| **IdP single sign-on URL**, **IdP entity id (issuer)**, **IdP signing certificate (PEM)** | SAML: the values from your identity provider. The page lists the ACS URL and entity id to give it in return |
| **Issuer URL**, **Client id**, **Client secret** | OpenID Connect: the values from your identity provider. The page lists the redirect URI. A saved secret is never shown again. Leave the field empty to keep it |
| **Email domains** | People with these email domains can use "Log in with SSO". Empty allows any email your identity provider sends |
| **Create members on their first SSO login** | Adds a person as a member the first time they sign in through SSO |
| **Role for new members** | Admin, Editor, Analyst, Viewer or Billing |
| **Enforce SSO** | Members must sign in through your identity provider. The owner keeps password access. It can be ticked only once the configuration is active |

Below the form, **Test SSO login** tries the configuration, **Activate**
turns it on after a successful test, and **Turn off** switches SSO off.
The status line shows Draft, Testing, Tested or Active.

**SCIM provisioning** lets your identity provider add and remove members.
**Generate SCIM token** shows the token once. Generating a new one stops
the old one. See [SCIM](/docs/teams/scim).

## White label

Business and up, and any paid plan of an approved agency. On other plans the fields are disabled. See
[White label](/docs/reports/white-label).

| Field | What it does |
|---|---|
| **Brand name** | Your name, up to 60 characters, shown on shared dashboards, embeds and email reports for every site in the workspace |
| **Logo URL** | An `https` link to a PNG, SVG or JPEG, shown about 32 pixels tall |
| **Accent color** | A six-digit hex color such as `#06755b` |
| **Hide Privatus Analytics branding** | Removes the Privatus Analytics name and logo from shared dashboards and email reports |

Custom dashboard domains and custom email sender domains are not
available. Shared dashboards use the Privatus Analytics address. Through
the API: `GET` and `PATCH /workspaces/<workspace id>/white_label` (MCP:
`white_label_get`, `white_label_update`).

## Legal documents

The DPA (which incorporates the EU Standard Contractual Clauses) and the
subprocessor list are on the [legal pages](/legal). See
[Privacy & compliance](/docs/privacy).

View as Markdown

Workspace at the foot of the menu opens the workspace's settings. The pages are tabs across the top, and you see only the tabs your permissions allow. Billing, Email reports and Exports are tabs too. Alerts open from the bell beside the search, and the workspace's dashboards from the site switcher.

Page	What's there	Permission
General	Name, default timezone and currency, workspace id (`ws_…`), and Delete workspace	`workspace.manage`
Members	Members with role, site access, 2FA status and last activity. Invite, change role or site access, remove, transfer ownership. See Teams	`members.manage` to change
Roles	What each built-in role can do and, on Business, custom roles	`members.manage` to change
Security	Require 2FA (Business), allowed login methods, session lifetime, IP allowlist (Business), support access	`workspace.manage`
SSO (Business)	SSO with SAML or OIDC, email domains and SCIM	`workspace.manage`
API tokens	Create, see last use, revoke. See Authentication	Any member for their own tokens, `tokens.manage` for other members'
Webhooks	Endpoints, events, signing secret, delivery log with Resend. See Webhooks	`workspace.manage`
White label (Business)	Brand name, logo and accent color on shared dashboards, embeds and email reports, and an option to hide Privatus Analytics branding	`workspace.manage`
Audit log	Who did what, when. See Audit log	`workspace.manage`
Billing (sidebar)	Plan, usage meter with forecast and per-site breakdown, change plan, payment method, billing emails, tax id, invoices, cancel. See Billing	`billing.manage`

Owner and Admin hold all of these permissions. See Roles and permissions.

General#

Field	What it does
Name	The workspace's name, up to 100 characters
Default timezone	The timezone a new site starts with. Changing it does not change existing sites
Default currency	A three-letter code such as `USD`. The currency a new site starts with. Changing it does not change existing sites
Benchmarks	On by default. Your sites are compared with what is typical across all sites (How you compare), and one number per site counts toward those benchmarks, which never name a site. Off, your sites are left out and the comparisons are hidden
Workspace id	The `ws_…` id used in API paths. It can't be changed

Save stores the form. Through the API: PATCH /workspaces/<workspace id> with name, timezone, currency and benchmarks (MCP: workspaces_update).

Delete workspace#

Only the owner sees this box. Type the workspace's name to confirm.

A paid subscription is canceled first. If that fails, nothing is deleted.
The workspace and all its sites stop collecting at once, and pending site transfers are canceled.
Everything is permanently deleted after 7 days.

Security#

Sign-in rules for every member, saved with one Save button. Workspace security settings explains each rule in detail.

Setting	Options	What it does
Require two-factor authentication (Business)	On or off	Members without an authenticator app or a passkey are sent to set one up before they can open the workspace
Allowed login methods	Email and password, Email login link, Passkey, Google, GitHub, Apple, SSO (SAML/OIDC)	The ways members may sign in. At least one must stay ticked. The owner can always sign in with a password or a passkey. The mobile app follows the same rules
Sign members out after	No limit, 8 hours, 24 hours, 7 days, 30 days	How long a sign-in lasts. A member of several workspaces gets the shortest of their limits
IP allowlist (Business)	IP addresses and CIDR ranges, IPv4 or IPv6, one per line	Only these addresses can open the workspace in the app or use its API tokens. Empty allows any address. The list must include your current address, which the page shows
Support access	On or off	Lets Privatus Analytics support view the workspace for 7 days from when you save. Clearing it ends the access. Without it, support staff can't see the workspace

Through the API: GET and PATCH /workspaces/<workspace id>/security (MCP: workspace_security_get, workspace_security_update). Over MCP workspace_security_update only returns a link to this page, see Actions for a person.

SSO#

Business only. On other plans the page shows an upgrade note. The full walkthrough is in Single sign-on.

Setting	What it does
SAML 2.0 or OpenID Connect	The protocol. The form shows only the fields of the one you choose
IdP single sign-on URL, IdP entity id (issuer), IdP signing certificate (PEM)	SAML: the values from your identity provider. The page lists the ACS URL and entity id to give it in return
Issuer URL, Client id, Client secret	OpenID Connect: the values from your identity provider. The page lists the redirect URI. A saved secret is never shown again. Leave the field empty to keep it
Email domains	People with these email domains can use "Log in with SSO". Empty allows any email your identity provider sends
Create members on their first SSO login	Adds a person as a member the first time they sign in through SSO
Role for new members	Admin, Editor, Analyst, Viewer or Billing
Enforce SSO	Members must sign in through your identity provider. The owner keeps password access. It can be ticked only once the configuration is active

Below the form, Test SSO login tries the configuration, Activate turns it on after a successful test, and Turn off switches SSO off. The status line shows Draft, Testing, Tested or Active.

SCIM provisioning lets your identity provider add and remove members. Generate SCIM token shows the token once. Generating a new one stops the old one. See SCIM.

White label#

Business and up, and any paid plan of an approved agency. On other plans the fields are disabled. See White label.

Field	What it does
Brand name	Your name, up to 60 characters, shown on shared dashboards, embeds and email reports for every site in the workspace
Logo URL	An `https` link to a PNG, SVG or JPEG, shown about 32 pixels tall
Accent color	A six-digit hex color such as `#06755b`
Hide Privatus Analytics branding	Removes the Privatus Analytics name and logo from shared dashboards and email reports

Custom dashboard domains and custom email sender domains are not available. Shared dashboards use the Privatus Analytics address. Through the API: GET and PATCH /workspaces/<workspace id>/white_label (MCP: white_label_get, white_label_update).

Legal documents#

The DPA (which incorporates the EU Standard Contractual Clauses) and the subprocessor list are on the legal pages. See Privacy & compliance.