Security and compliance
Set up sign-in protection, use the audit log, switch on PII redaction and request compliance documents.
The Security & compliance section is where workspace admins find the audit log and the compliance settings. It has three tabs: Compliance, Audit log and Settings. The section needs the Business or Enterprise plan; on Free it explains what the plan adds.
Sign-in and two-factor authentication
Passwords are checked against known data breaches when they are set. Two-factor authentication uses an authenticator app: you scan a QR code, then enter a 6-digit code.
- Set it up. Open your account settings and use the two-factor section, or follow the prompt at sign-in.
- Who must use it. Workspace admins on the Business and Enterprise plans are required to set it up; they are sent to Set up two-factor authentication until they do. Agency admins must use it too. When a role change makes it required, you get a notification and an email first; you set it up at your next sign-in. Anyone else can switch it on voluntarily.
- Sign in. With it on, you enter a code on Two-factor authentication after your password.
- Recovery codes. You can generate recovery codes in case you lose your authenticator app.
Enterprise customers can ask their account manager about SSO, which is set up with them rather than in the console.
When an admin uses Change email on People, a confirmation link goes to the new address and the current address is informed. Nothing changes until the link is opened.
The audit log
Open the Audit log tab for a record of what happened in the workspace. It covers privacy events (PII detected, Anonymized, PII ignored), LLM interactions, Admin actions and Governance events such as access grants and role changes. It shows who did what and when, and records metadata only, not message content.
Filter
Use Filter, Actor and the From and To dates to narrow it down.
Inspect
Choose Show full record on a row for the details.
Export
Choose Export CSV or Export JSON. The export uses the filters and dates you set.
The log is append-only: entries cannot be edited or deleted.
PII protection
Under Settings, PII redaction is off by default. When you switch it on, detected personal data such as names, email addresses, phone numbers and IBANs is redacted from a chat message and its context before it is sent to the AI model. The original stays in your organisation.
This reduces exposure but is not a guarantee: automatic detection can miss personal data. The page says so. If redaction is off, a warning tells you that personal data reaches the model as typed, with a button to turn it on.
Manual anonymization is a separate rule that lets people replace personal data with placeholders such as [NAME] or [EMAIL] before sending a message.
EU AI Act and compliance
- AI Act compliance module. It is on by default for new workspaces. Switching it on activates the compliance rules below.
- AI transparency label. A visible label in chat interfaces tells people they are communicating with an AI system.
- Prohibited-use scan. Messages are scanned against the EU AI Act categories of prohibited use before being sent to the model. A blocked request shows Request blocked with the matched category and a way to edit and retry.
- AI systems. An inventory of every agent and workflow with its risk classification and oversight records.
- Compliance reports. Under Compliance reports you generate a dated PDF for one period (Generate), keep a history and compare two reports.
- Compliance documents on request. Under Request compliance documents, ask for your Processing register or the Subprocessor list (Request). AgentWorks reviews the request and sends the document to your email address. You are also told automatically when a subprocessor is added or retired.
Where your data is processed
AgentWorks runs as a multi-tenant service hosted in the EU. The Models page labels each model EU or US, so you can choose models that match your requirements. See Access.
Agency access
If an agency manages your workspace, it can only open your workspace as one of your users when you allow it. Open General in the Workspace console and find Agency access:
- Allow for 24 hours or Allow for 7 days lets your agency open the workspace as your workspace admin to help you.
- Revoke access ends it at once, also in the middle of a session.
You get a notification each time the agency opens your workspace. When the agency asks for access, you get a notification and an email. Workspace admins only.