Skip to content

Security policies

Security policies let an org admin require security controls across every member. A member who doesn’t meet the policy is blocked at the next sign-in until they configure the required factor.

Security policies are a Pro+ feature. Configure them at Settings → Security policies.

What you can require

PolicyWhat it enforces
Require 2FAEvery member must have TOTP 2FA enabled. New members are prompted during onboarding.
Require passkeyEvery member must have at least one passkey registered. Stricter than 2FA — phishing-resistant.
Require email verifiedEvery member’s email must be verified before they can access org resources. On by default for new orgs.

Policies stack — turning on Require 2FA AND Require passkey means every member must have both enabled. Owners are subject to the same policies as everyone else.

Email verification gate (platform-wide)

Independently of the policy, PathWatch hard-blocks every /api/v1/* endpoint (reads included) for accounts whose email isn’t verified. The only routes that stay open are the self-service profile, export, sign-out, and account-delete paths under /api/v1/user/*.

Unverified accounts older than 7 days are deleted by a sweeper that runs every 6 hours. This is the same purge that protects against spam signups; legitimate users only need to click the verification link in their welcome email.

API keys bypass the gate because PathWatch only issues keys to verified users.

Automatic enforcement

Mandatory 2FA is auto-enabled for owners of paid orgs. Upgrading your org from Free to any paid plan flips Require 2FA on for the owner immediately.

The next sign-in after the upgrade prompts the owner to set up TOTP if they haven’t already.

Personal orgs

Security policies apply to team orgs only. A personal org is solo by design — there are no other members to enforce against. Your own account-level security settings still apply.

Enforcement timing

Existing members keep their session. The next sign-in (or session refresh) checks the policy. Non-compliant members see a “set up X to continue” screen and can’t access org resources until they do.

Auditing

Every policy enable / disable / change writes to the audit log with the actor and diff. Use this to track when each control was rolled out.

Tips

  • Phase rollouts: announce internally, give a week, then enable. Avoid catching teammates mid-sprint without an authenticator.
  • Pair 2FA with passkeys — let people choose. Passkeys are smoother once set up; TOTP is a fallback that works on any device.
  • The email-verified requirement is mostly a no-op for everyday users — but it kills spam-signup waves dead.