- email-based 2FA: on or off, on by default for new accounts, and whether people may turn it off;
- Enforce SSL, if your proxy doesn't already redirect to HTTPS;
- a captcha on the sign-in and sign-up forms: Cloudflare Turnstile, hCaptcha or Google reCAPTCHA;
- checking that sign-up addresses can receive mail (Abstract API), and an email domain policy: accept every domain, or only the ones you list;
- the link policy for published docs: allow links to every domain, only to allowed domains, or block the domains you list. It applies to every site on the platform.
Password-protected sites rate-limit wrong passwords on their own: five a minute and thirty an hour per visitor and site, after which even the right password waits.
Then review Admin → Settings → Compliance: the cookie notice, whether people may change their email address, and account deletion: on or off, immediate or with a waiting period people can cancel (14 days), and whether owning a workspace or an active subscription blocks it until resolved. Deletion requests show in Admin → Users.