> For the complete documentation index, see [llms.txt](https://docs.unitlab.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.unitlab.ai/documentation/security/security-overview.md).

# Security overview

Unitlab security is a set of connected identity, access, credential, data-handling, and operational controls. The organization remains responsible for configuring those controls according to its data classification and regulatory obligations.

{% hint style="info" %}
**Use this area when:** you are onboarding a workspace, connecting cloud storage, issuing API keys, handling sensitive data, or reviewing production access.
{% endhint %}

### How this area fits into production

```mermaid
flowchart TB
  A["Human or service identity"]
  B["Authentication"]
  C["Workspace role"]
  D["Project + workflow scope"]
  E["Data/model/release action"]
  F["Review + revocation"]
  A --> B
  B --> C
  C --> D
  D --> E
  E --> F
```

![Personal Account security page with password and two-factor authentication controls](https://292810646-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGjVLUz4wthGkGlRKM6rM%2Fuploads%2FJrstdUsQmqNdGlH4P2Mp%2Faccount-security.png?alt=media\&token=8a678b4a-9d4c-463b-b462-17986926e8fa)

*Personal Settings › Account security is the human sign-in control surface. It shows password management, 2FA status, the Enable 2FA action, and the account danger zone; role-based authorization is configured separately at workspace and project scope.*

### What this area controls

Unitlab supports email/password sign-up and sign-in, Google authentication, email verification, invitation-token access, password reset, and TOTP two-factor authentication.

Two-factor authentication includes QR/secret setup, verification, ten single-use backup codes shown once, login challenge, disable, and backup-code regeneration. When 2FA is enabled, password change, password-reset completion, account deletion, and workspace destruction require an appropriate second factor.

If a user refreshes during the temporary 2FA login challenge, the challenge is cleared and the user returns to login rather than leaving reusable sensitive state in the browser.

### Start with the right page

| Decision               | Production guidance                                                                                             |
| ---------------------- | --------------------------------------------------------------------------------------------------------------- |
| Protect sign-in        | Change compromised passwords and enable TOTP two-factor authentication in Personal Settings › Account security. |
| Control access         | Use workspace roles, permission groups, project assignment, and workflow eligibility.                           |
| Protect automation     | Create, store, rotate, disable, and delete API keys from Workspace Settings › API keys.                         |
| Connect source systems | Add cloud storage with a dedicated least-privilege identity and exact prefix.                                   |
| Handle sensitive data  | Apply organization policy to screenshots, exports, logs, source paths, and releases.                            |
| Remove access          | Use the offboarding runbook and verify denial after ownership transfer.                                         |

### Operating boundary

* Do not place secrets, signed URLs, regulated content, or private source paths in public docs or tickets.
* A personal user credential is not a service identity strategy.
* Access reviews must include in-flight tasks, integrations, model endpoints, keys, and release destinations.

### A production-ready handoff

Every privileged identity and connection has an owner, minimum scope, approved secret location, rotation and revocation path, review date, and tested failure behavior.