# Security & compliance

Review Admin → Settings → Security:

- enable email-based 2FA and decide whether it is enabled for new registrations;
- decide whether users may disable 2FA;
- enforce SSL if HTTPS redirects are not already handled by your proxy;
- configure Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA for authentication forms;
- optionally validate registration addresses with Abstract API.

Then review `Admin → Settings → Compliance`:

- email-change verification and cookie consent;
- account deletion workflow, cooldown, cancellation, and administrative review;
- blockers that protect shared workspaces, unresolved billing, and active runs/approvals.

Publish accurate Terms, Privacy, Acceptable Use, and other required pages from the Public Pages resource. The optional age-consent dialog is only relevant if your own deployment needs it.

<Warning>
AI prompts, integration payloads, knowledge sources, and run outputs may contain customer data. Choose retention, logging, backup, and provider policies appropriate for your jurisdiction and customers.
</Warning>