Security controls: IP allow-lists, confirm it's you, the DPA in one click

A round of controls that security reviewers ask about, and a few that protect your AI credits and your website visitors.

• IP allow-lists. Limit where your workspace can be used from: signing in, the API and AI connections. Each API key can have its own list too. Settings ▸ Security.
• Confirm it's you. Creating an API key, changing single sign-on or changing someone's role now asks for your password if you signed in more than 15 minutes ago.
• Legal. Settings ▸ Legal shows which version of the Terms, Privacy Policy and Acceptable Use Policy your workspace accepted, and lets an admin accept the Data Processing Addendum in one click, with a PDF record.
• Daily AI budgets. The website chat, the text bot, social replies and flows each get a day's AI budget, so a spam run can't spend the month's credits. Settings ▸ AI assistant.
• Outbound webhooks. A delivery log with Send again, secret rotation that keeps the old secret working for a day, and endpoints that fail for a week are switched off with a notice.
• Website tracking privacy. Consent mode, Global Privacy Control, shortened IP addresses, your own domains only, and bots left out.
• API retries. Every API POST accepts an Idempotency-Key, so a retried request runs once.
• Single sign-on. Each SAML response is accepted once, and sign-in from the identity provider's dashboard can be switched off.