Workspace security

This page is the admin’s view of how Knobs keeps a workspace safe — what’s enforced by the platform, what you control, and what to encourage your team to do.

The workspace boundary

The workspace is a hard wall. Members of one workspace can never see another workspace’s mail, files, docs, or channels — even when the same person belongs to both, each workspace’s data stays scoped to it. The All Domains view rolls a user’s own workspaces together for convenience, but never crosses permissions between them.

Within a workspace, access is deny-by-default: docs, sheets, files, and calendars are private to their creator until explicitly shared. See Sharing & access.

What roles can reach

• Owners and admins manage members, domains, integrations, and billing — and have implicit access to every doc, sheet, and calendar in the workspace. Choose admins accordingly.
• Members get full product use with no administrative reach.

Role changes and removals take effect immediately — Members & invites.

Sign-in and account credentials

Each member manages their own credentials under Settings → Security (Account security):

• Password, passkeys, and linked GitHub sign-in.
• Two-factor authentication — authenticator app (TOTP) or SMS.
• Recovery contacts — a verified personal email or phone, required at onboarding. Account recovery runs through these with a one-time code; Knobs never sends a password-reset link to the (locked-out) knobs inbox. See Recovery contacts.

Tip

Encourage — or require by team policy — passkeys plus 2FA for everyone. Both enroll in under a minute from Settings → Security.

Mail authentication

Custom domains are set up with DKIM, SPF, and DMARC as part of domain verification, so mail from your domain is cryptographically signed and hard to spoof. Inbound mail is checked against the same standards, plus spam and virus scanning; failing mail is quarantined or spam-foldered.

API keys and integrations

Two kinds of programmatic access exist, with deliberately different shapes:

• Personal API keys — a member can mint keys that act as that user, with exactly that user’s permissions, for scripts and tools. Keys are shown once, stored hashed, individually revocable, and can never manage credentials — an API key can’t add passkeys, change 2FA, touch recovery contacts, or mint more keys. Members manage theirs in Settings → Security; see Account security and the API keys reference.
• Integration tokens — workspace-level bots you register under Settings → Integrations, scoped to chat capabilities, with signed webhooks and a delivery log. See Integrations.

Both are hashed at rest, shown exactly once, and revocable immediately.

Audit trail

Security-relevant events are recorded per workspace: membership and role changes, invites, domain changes, file shares and cross-workspace shares, integration lifecycle changes, and AI invocations. This gives you an answer to “who did that, and when” without guesswork.