Security
This page is a catalog, not a full settings screen. Most rows are informational, link to the surface that owns the setting, or are marked Available in Enterprise. One row below is a live setting.
The one setting that works
Default tool mode for new workflows — Automatic or Needs approval, shipping as Needs approval. This is the starting posture for every workflow drafted from here on. Per-tool settings on each workflow’s Access tab tune it further.
Rows that link elsewhere
The audit-log row describes changes as attributed and revertable. Neither is true yet — see Activity.
Never used for training
Static and always on: nothing from this workspace trains Alma’s models or anyone else’s, on every plan.
Available in Enterprise
The remaining rows are grouped by concern — Authentication, Membership & invites, Data protection, AI guardrails, Developers & network, and Audit & compliance — and link to Billing. They cover SSO and SAML, SCIM provisioning, session length, allowed email domains, data residency and retention, model defaults, IP allowlisting, and SOC 2 evidence.
A lock chip means the control isn’t self-serve, not that the underlying protection is absent — encryption in transit and at rest, and row-level data scoping, apply to every workspace regardless of plan. For SOC 2 reports, SSO/SCIM, data residency, or customer-managed encryption, email help@alma.team.
Coming soon. The SOC 2 Download button never appears, and Sign out all sessions is a locked chip rather than a working button.
Where security actually gets configured
| Concern | Where |
|---|---|
| What Alma may do in a tool, and who | Connections → Tools & access |
| Who approves what, per workflow | Workflows → Access |
| Who can see a topic | Memory → Topics |
| Who holds admin | Members |
| What external callers can read | API |