# Your profile, security and sign-in

Source: https://pozy.ai/help/workspace/security-and-sign-in

## Your profile

Your name, email and password belong to you, not to the workspace. Open **Settings**, then **Profile**.

- **Photo and name:** choose **Upload photo**, or change your **Name** and choose **Save**.
- **Email address:** choose **Change email**, type the **New email** and choose **Send confirmation**. Nothing changes until you open the link we send to the new address. If your email shows **Not verified**, choose **Send verification email**.
- **Password:** type your **Current password** and a **New password** of at least 8 characters, then choose **Change password**. If you sign in with Google, choose **Set a password** instead. You need one to sign in with your email and to turn on two-step verification.

The rest of this guide lives in **Settings**, then **Security**.

## Turn on two-step verification

After your password, Pozy asks for a 6-digit code from an app on your phone, like Google Authenticator, 1Password, Authy or Apple Passwords.

1. Open **Settings**, then **Security**, and choose **Turn on** under **Two-step verification**.
2. Confirm your password.
3. Scan the QR code with your authenticator app, then type the code it shows.
4. Save your 10 backup codes somewhere safe and choose **I saved them**. Each one signs you in once if you lose your phone.

It protects password sign-in. If you sign in with Google, your Google account's own security protects you instead. If you only ever used Google, set a password on the **Profile** tab first.

## Sign out a device

Under **Sessions and devices** you see every device signed in to your account. Choose **Sign out** next to one you do not recognize, then change your password. **Sign out everywhere** ends every session, including this one.

## Single sign-on for your team

With single sign-on (SSO), your team signs in through your company login, such as Okta, Microsoft Entra ID or Google Workspace. Your company's own rules and two-step checks then apply.

- Only the workspace **owner** can set it up, in the **Single sign-on (SSO)** panel.
- You prove you own your email domain by adding a record at your domain provider.
- New people who sign in this way join as **Member**.
- Once it works, the owner can turn on **Require SSO** for your domain. Password and Google sign-in then stop for those addresses.

The step-by-step setup is in the [single sign-on docs](https://pozy.ai/docs/security/sso).

## Or ask your AI

> Which AI apps are connected to my Pozy account, and when was each one last used?

The same list is always in **Settings**, then **Connected apps**. Two-step verification and SSO are set up by you, in the dashboard.

## Plainly, what we have and do not have

| Feature | Today |
|---|---|
| Two-step verification | Yes, per person |
| Single sign-on (SAML or OIDC) | Yes, set up by the owner |
| Automatic user sync from your company directory (SCIM) | Not available yet. Remove people on the **Team** page when they leave |
| Choosing where your data is stored | Not available. Data is kept in the United States and the European Union |
| Certifications (SOC 2, ISO 27001) | Pozy does not hold these today |

## Good to know

- Two-step verification does not touch your AI connections or API keys. Revoke those in **Settings**, then **Connected apps**. See [Control what your AI can do](https://pozy.ai/help/workspace/ai-access).
- Lost your phone and your backup codes? Email support@pozy.ai from the address on the account.
- More detail on how Pozy keeps data safe: [Security](https://pozy.ai/security) and [Data residency](https://pozy.ai/docs/security/data-residency).

**Related:** [Invite your team and pick roles](https://pozy.ai/help/workspace/team-and-roles)