Platform security
The workspace-level controls that protect your account. Two-factor enforcement, the AI integration kill switch, API key restrictions, and the audit trail.
Last update:
This page lists the controls that secure a CentralCSP workspace, and where each one lives.
CentralCSP does not claim ISO 27001 or SOC 2 certification.
The four controls worth setting
Four workspace controls do most of the work, and each one lives in a different place:
| Control | Where | Effect |
|---|---|---|
| Require two-factor authentication | Settings > General | Blocks members who have not enrolled from the workspace entirely |
| Disable AI agent integrations | Settings > General | Refuses every Model Context Protocol (MCP) session for this workspace |
| API key IP restrictions | Settings > API keys | A key works only from the addresses you list |
| Website access control | Each website's Settings | Limits which sites a member reaches |
Two-factor enforcement
Two-factor enforcement applies to API access as well as the dashboard. For more information, refer to Two-factor enforcement.
The AI kill switch
Disable AI agent integrations stops every AI tool from reaching this workspace. Existing MCP sessions are refused from the next request, and no new one can be created. Turning the switch off again restores access.
Use it as an incident control, or as a standing policy if AI access is not something your organization has approved. For more information, refer to MCP.
What to know about API keys
Keys have no scopes. A key acts as the person who created it, with that person's current roles, limited to the one workspace.
That makes the creating account the real permission boundary. A key created by a workspace Admin reaches every website. Create keys from an account with the narrowest access that still does the job, restrict them by IP, and set an expiry.
Keys cannot be edited. Changing the IP list or expiry means revoking and reissuing. For more information, refer to API keys.
Authentication
Sign-in, passwords, two-factor, and passkeys are managed under Account. For more information, refer to Two-factor authentication.
There is no Security Assertion Markup Language (SAML) or enterprise single sign-on (SSO) integration.
The audit trail
Administrative actions are recorded until the account is deleted, and cannot be edited or removed before that. Review the trail periodically, particularly api_key.created, access.member_granted, and member.role_updated. For more information, refer to Audit logs.