Account and workspace security
Manage passwords, passkeys, two-factor authentication, sessions, and account access.
Personal security settings protect your sign-in. Workspace security settings let owners set supported authentication requirements for the team. Role, object, and field permissions control what people can do after they sign in.
Choose a sign-in method
Matte supports email and password, Google sign-in when configured, and registered passkeys on supported browsers and devices. A workspace-specific sign-in link helps you arrive at the correct workspace and its branding.
Use Forgot password? from the sign-in screen to start the password-reset flow. In User Settings → Security, Change password lets you replace your current password while signed in.
Security also shows password health information. Account-sensitive operations may ask you to authenticate again, even if the rest of the app is already open.
Add and manage passkeys
A passkey can use a fingerprint, face, device PIN, or security key, depending on your device. The browser controls the registration and verification prompts; Matte does not need your fingerprint or device PIN.
If passkey sign-in is unavailable, check browser and device support and use another configured sign-in method. Register a usable credential before depending on it for future access.
- Open User Settings → Security and find Passkeys.
- Start the add-passkey flow. Choose the default setup, this device, or a security key where the browser offers those options.
- Complete the browser or operating-system prompt using the supported device verification method.
- Review the registered passkeys in Matte. Give them recognizable names and remove credentials you no longer use.
Turn on two-factor authentication
Matte uses time-based authenticator codes. Recovery codes provide a backup sign-in path, and you can regenerate them in Security. Treat the latest set as the one to retain.
Remembered browsers can avoid repeated two-factor prompts for a period of time. Review the remembered-browser list and forget devices that should no longer be trusted. This is separate from terminating an active session.
- Open the two-factor authentication controls in User Settings → Security.
- Add the setup details to an authenticator app and enter the current code to verify it.
- Save the recovery codes somewhere you can access if your authenticator becomes unavailable.
- On later password sign-ins, enter the requested authenticator code or use an available recovery code.
Set a workspace two-factor policy
Workspace Settings → Security offers Require admins and Require everyone, subject to plan support. These controls require authenticator-based two-factor authentication for the covered users when they sign in with a password.
Owners choose a Grace period so covered members have time to enroll before the policy blocks unenrolled password sign-ins. The current workspace UI reserves policy changes for owners.
The wording specifically concerns password sign-ins. Do not assume it is a separate, universal second prompt for every passkey or Google sign-in. Use the displayed policy and enrollment messages to understand the current requirement.
Review signed-in devices and security activity
User Settings → Account lists active sessions with available browser, device, and activity details. Sign out of this device ends your current session. Terminate all others ends other active sessions without signing out the one you are using.
Security provides recent security activity where your access allows it. The workspace security activity panel is owner-gated in the current UI. Events can include authentication changes and workspace access changes.
Record Activity and security activity serve different purposes. Use record timelines for data changes and comments, and security activity for account or permission events.
Protect access to workspace data
Roles, seat types, individual overrides, object permissions, and field visibility work together. Field restrictions continue to apply to search, exports, APIs, and agents. A saved view or an agent request does not grant extra access.
API keys can be scoped and revoked. Their effective access also depends on the current user or service-account permissions and workspace entitlements. Share the smallest access needed for an integration, and revoke credentials that are no longer used.
Download account information and delete an account
User Settings → Account includes the account-deletion flow. Before confirming, Matte checks your workspaces and explains the effect on shared and solo workspaces. It can block deletion when you are the only owner of a shared workspace.
The deletion dialog offers Download your data, which downloads a JSON account export. Review the recovery date and confirmation requirements shown in the dialog. Deleting your account is different from leaving one workspace or deleting a record.
The separate Export data card in User Settings → Security is marked Coming soon. Use the existing record CSV exports or the account-export control for their specific purposes; a general workspace CSV/JSON backup request is not available through that card.