# Platform security (/en/docs/platform/security/platform-security)



This page lists the controls that secure a CentralCSP workspace, and where each one lives.

CentralCSP does not claim ISO 27001 or SOC 2 certification.

## The four controls worth setting [#the-four-controls-worth-setting]

Four workspace controls do most of the work, and each one lives in a different place:

| Control                                                                 | Where                   | Effect                                                                |
| ----------------------------------------------------------------------- | ----------------------- | --------------------------------------------------------------------- |
| **Require two-factor authentication**                                   | Settings > General      | Blocks members who have not enrolled from the workspace entirely      |
| **Disable AI agent integrations**                                       | Settings > General      | Refuses every Model Context Protocol (MCP) session for this workspace |
| **API key IP restrictions**                                             | Settings > API keys     | A key works only from the addresses you list                          |
| **[Website access control](/en/docs/platform/websites/access-control)** | Each website's Settings | Limits which sites a member reaches                                   |

## Two-factor enforcement [#two-factor-enforcement]

Two-factor enforcement applies to API access as well as the dashboard. For more information, refer to [Two-factor enforcement](/en/docs/platform/security/mfa).

## The AI kill switch [#the-ai-kill-switch]

**Disable AI agent integrations** stops every AI tool from reaching this workspace. Existing MCP sessions are refused from the next request, and no new one can be created. Turning the switch off again restores access.

Use it as an incident control, or as a standing policy if AI access is not something your organization has approved. For more information, refer to [MCP](/en/docs/platform/integrations/mcp).

## What to know about API keys [#what-to-know-about-api-keys]

Keys have **no scopes**. A key acts as the person who created it, with that person's current roles, limited to the one workspace.

That makes the creating account the real permission boundary. A key created by a workspace Admin reaches every website. Create keys from an account with the narrowest access that still does the job, restrict them by IP, and set an expiry.

Keys cannot be edited. Changing the IP list or expiry means revoking and reissuing. For more information, refer to [API keys](/en/docs/platform/integrations/api-keys).

## Authentication [#authentication]

Sign-in, passwords, two-factor, and passkeys are managed under **Account**. For more information, refer to [Two-factor authentication](/en/docs/platform/account/mfa).

There is no Security Assertion Markup Language (SAML) or enterprise single sign-on (SSO) integration.

## The audit trail [#the-audit-trail]

Administrative actions are recorded until the account is deleted, and cannot be edited or removed before that. Review the trail periodically, particularly `api_key.created`, `access.member_granted`, and `member.role_updated`. For more information, refer to [Audit logs](/en/docs/platform/security/audit-log).

## Next steps [#next-steps]

* [Two-factor enforcement](/en/docs/platform/security/mfa)
* [API keys](/en/docs/platform/integrations/api-keys)
* [Audit logs](/en/docs/platform/security/audit-log)