Few owners. Only people you would trust with everything hold Owner. Check Users and rights → Users. See the .

Manage Members is not Owner, but it is close. A person with it, including an Admin invite role, can add and remove people and grant every right except Owner. Only an owner (or a platform administrator) can give or take away Owner, so an Admin cannot make themselves an owner. Manage Members still decides who can open the space, so hand it only to people you trust with your data.

Roles match jobs. Most people should be Read-only or Editor. Use Admin sparingly.

Leavers are removed. Use Remove member under Users. Removing someone from a group does not remove rights granted to them directly.

Someone else can recover the space. There are at least two owners, and you know who the space is billed to (Billed to).

Groups for customers are External. Customer groups are created under External Users. See .

Nothing is shared by accident. Review which items have Publish in the external portal switched on (External users access…). A folder shares its whole subtree.

Self-registration is off unless you want it. In External Users → Settings, Users can self-register without a pre-created account puts anyone who proves an email address into the directory's Default external group. For a private portal choose Invite-only.

Every shared table has a row rule. A table with no Row filter is refused for customers, not shown in full. Check External users access… → What they see.

Columns are shared on purpose. After the first save under Column visibility, new columns stay hidden from customers until you share them. Before the first save they do not.

The CORS list is short and yours. Under External Portals → CORS settings, keep only websites you control. Never add shared-hosting or sandbox sites. Each entry can read portal answers, probe which pages exist, skip the extra sign-in check, and receive sign-in links. See .

The portal address is real. The Portal URL on Overview is not the fallback address. Ask your administrator if it warns you.

You know what "published" opens. Publishing a form or any item publishes the space too, and unpublishing the form later does not unpublish the space. See .

No sensitive table is published. Publishing a data table makes every row readable by anyone with the link. There is no per-visitor filtering on the public side.

Forms with pickers are reviewed. The Publish dialog lists Tables this form needs published. Publish only the ones whose rows are safe to show.

Nothing private is in the Asset Library or pasted into documents as an image. These files open from their address with no sign-in, published or not. The address is an unguessable random name, but it is not secret. Files attached to rows are protected.

Dashboards use totals. Prefer Allow totals only to publishing the source table. See .

Captcha really works. A form with Require Cloudflare Turnstile still accepts anonymous submissions when the installation has no captcha secret saved: the check is skipped. Ask your administrator to confirm. See .

Personal data capture is deliberate. IP address, browser and UTM values on a form are personal data. See .

Automations are reviewed after a copy or import. Rules that send email or messages, call outside addresses, run agents, open payment links or fetch rates arrive switched off. Switch each on only after reading it. See .

Connector credentials belong to the space. Only an Owner can change connectors. Duplicate project by an owner is a full copy and carries credentials, portal users, groups and grants. Use as a template on a demo strips them. See .

Export files are guarded like passwords. A space export contains connector credentials and portal users' email addresses; someone holding the file and the app code can recover the credentials. Share it only with people you trust.

Payment provider is in test mode until you mean it. See .

Your own AI key is yours. If Provider enabled is off, agents silently use the platform key and credit.

Backups are on, if your plan allows. Backups saves table CSVs to your storage. It is not a full-system backup. See .

You have exported at least once. Export / Import gives a file you can restore from; test the import in a copy.

Hidden columns are hidden from exports too. Exporting a table to CSV or XLSX needs only Read, so a column you hide from a group is also kept out of that group's export.

Audit log is looked at. Audit log shows who changed the space's structure. Look after any staffing change.

Row and column rules inside your team are set where staff should not see everything (Row visibility, Column visibility in Manage access…).