For everyone
- Add a passkey (fingerprint, face or screen lock) in Account, Sign-in and security. It cannot be phished.
- Or turn on two-step verification with an authenticator app, and keep the recovery codes safe.
- Review the devices you are signed in on and sign out the ones you do not recognise.
For admins
- Require two-step verification for the whole organization.
- Give people the lowest role that lets them work: Guest, Member, Manager, Admin.
- Use team-only project visibility so teams see their own projects.
- On Business: single sign-on (OpenID Connect or SAML), SCIM provisioning, an IP allowlist, and the audit log of sign-ins and permission changes.
Your data
- Hosted in India on Google Cloud (Mumbai), with daily backups kept 14 days.
- Owners can export everything as files at any time.
- Anyone can ask for their account to be deleted from Account, Profile.