Course 14 · Security governance

Governance is not a document written once. It is a few settings and a rhythm this course sets.

By the end of this lesson you will set the security defaults every owner sets in the first week. Start with your own account, because you are about to hold everyone's keys.

The account security section holds your own locks. Two-factor is the highest-value step you control. Turn it on before anything else here, and the sign-in screen then asks for a rotating code in place of your password.

You register an authenticator app by scanning the code shown, then confirm one six-digit code. Save the backup codes somewhere safe, because they are how you get back in if you lose the phone.

Active sessions are every place your account is currently signed in. One button signs out everywhere else, which is what you reach for the moment a laptop goes missing or something feels wrong.

Sign-in history answers one question, was that me. Every device that has reached your account, when it was first seen and last active. An entry you do not recognize means change your password, which signs out every other session.

Organization policy sets the requirement for everyone, two-factor here, plus single sign on if you run an identity provider. New members wait at setup until compliant.

By the end of this lesson you will read the audit log and answer who saw a given file. It records who did what, and treats a file view and a file download as separate events, because opening a document and saving a copy differ.

Each entry carries the actor, the device and address, and the moment it happened. The filters narrow to downloads, views, uploads, deletions, or member changes, and you can save a slice you audit often.

Export the whole log as a CSV for a reviewer, or stream every event to your security tools through a webhook. Most owners never need to configure a thing here. Knowing the record exists, complete and exportable, is most of what an auditor is asking for.

By the end of this lesson you will run an access review and handle someone leaving. Starting a review snapshots your whole access surface at that moment, every member and role, every team membership, every restricted document grant.

You then work down every line, confirming access that is still right and revoking what is not. Revocation takes effect at once. A person who should leave the organization is flagged here, not removed here; you finish that on the members page, which protects the last owner and ends their sessions.

Complete becomes available only once every line is decided, so a finished review always covers everything, and every decision is written to the audit log. The stored attestation is what you hand an auditor who asks how you govern access.

By the end of this lesson you will set how long data lives and how it leaves. Retention, export, and deletion live here; each hard deletion writes a certificate.

Keep it, export it, or delete it. You can request an export or a deletion, and our team processes the deletion and confirms by email.

Retention auto-deletes contracts a set number of months after upload, files and all. Leave it blank to keep them until you delete them, which suits most estates.

Data lives in the United States, plainly stated here. Two questions before you go. One, what does the audit log record? Two, what does a completed access review prove?

Replay any fuzzy lesson. Now you, turn on the org two-factor baseline today, five minutes. Next, Course 15, Branding, currency, billing, and plans.