Security controls: IP allow-lists, confirming it's you, and the DPA

Allowed IP addresses

In Settings ▸ Security ▸ Allowed IP addresses, an admin can list the addresses or ranges your workspace may be used from, one per line (for example 203.0.113.10 or 198.51.100.0/24). The list applies to signing in, to API keys and to AI connections. The card shows your own address, and a list that leaves it out is refused so you can't lock yourself out. Each API key can also have its own list in Settings ▸ API & webhooks, on top of the workspace's.

Confirm it's you

Creating an API key, changing its scope, adding or changing single sign-on, adding a SCIM directory, changing the allow-list and changing someone's role or access ask you to confirm it's you when you signed in more than 15 minutes ago. Enter your password (or a code from your authenticator if you have no password) and the change goes through. Each confirmation appears in the Audit log.

Single sign-on

Every SAML sign-in response is accepted once: a captured one sent again is refused and recorded in the Audit log. Under Settings ▸ Single sign-on, each SAML connection has a switch for sign-in started from your identity provider's dashboard (the app tile in Okta or Microsoft); turn it off to accept only sign-ins that start on Solstral's login page.

Legal agreements and the DPA

Settings ▸ Legal lists the Terms of Service, Privacy Policy, Acceptable Use Policy and Data Processing Addendum, the current version of each, and which version your workspace accepted. The first three are accepted when the workspace is created. To accept the DPA, enter your name and role, tick the box and press Accept the DPA; then download the PDF record for your files.