Security & compliance

• enable email-based 2FA and decide whether it is enabled for new registrations;
• decide whether users may disable 2FA;
• enforce SSL if HTTPS redirects are not already handled by your proxy;
• configure Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA for authentication forms;
• optionally validate registration addresses with Abstract API.

Then review Admin → Settings → Compliance:

• email-change verification and cookie consent;
• account deletion workflow, cooldown, cancellation, and administrative review;
• blockers that protect shared workspaces, unresolved billing, and active runs/approvals.

Publish accurate Terms, Privacy, Acceptable Use, and other required pages from the Public Pages resource. The optional age-consent dialog is only relevant if your own deployment needs it.