Security policies
Security policies let an org admin require security controls across every member. A member who doesn’t meet the policy is blocked at the next sign-in until they configure the required factor.
Security policies are a Pro+ feature. Configure them at Settings → Security policies.
What you can require
| Policy | What it enforces |
|---|---|
| Require 2FA | Every member must have TOTP 2FA enabled. New members are prompted during onboarding. |
| Require passkey | Every member must have at least one passkey registered. Stricter than 2FA — phishing-resistant. |
| Require email verified | Every member’s email must be verified before they can access org resources. On by default for new orgs. |
Policies stack — turning on Require 2FA AND Require passkey means every member must have both enabled. Owners are subject to the same policies as everyone else.
Email verification gate (platform-wide)
Independently of the policy, PathWatch hard-blocks every
/api/v1/* endpoint (reads included) for accounts whose email
isn’t verified. The only routes that stay open are the
self-service profile, export, sign-out, and account-delete paths
under /api/v1/user/*.
Unverified accounts older than 7 days are deleted by a sweeper that runs every 6 hours. This is the same purge that protects against spam signups; legitimate users only need to click the verification link in their welcome email.
API keys bypass the gate because PathWatch only issues keys to verified users.
Automatic enforcement
Mandatory 2FA is auto-enabled for owners of paid orgs. Upgrading your org from Free to any paid plan flips Require 2FA on for the owner immediately.
The next sign-in after the upgrade prompts the owner to set up TOTP if they haven’t already.
Personal orgs
Security policies apply to team orgs only. A personal org is solo by design — there are no other members to enforce against. Your own account-level security settings still apply.
Enforcement timing
Existing members keep their session. The next sign-in (or session refresh) checks the policy. Non-compliant members see a “set up X to continue” screen and can’t access org resources until they do.
Auditing
Every policy enable / disable / change writes to the audit log with the actor and diff. Use this to track when each control was rolled out.
Tips
- Phase rollouts: announce internally, give a week, then enable. Avoid catching teammates mid-sprint without an authenticator.
- Pair 2FA with passkeys — let people choose. Passkeys are smoother once set up; TOTP is a fallback that works on any device.
- The email-verified requirement is mostly a no-op for everyday users — but it kills spam-signup waves dead.