> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace security controls

> Verify workspace domains and restrict requests with an IP allowlist.

<Badge color="blue" size="lg" shape="pill" stroke="true">Feature available with the [Enterprise Plan](https://orq.ai/solutions/enterprise)</Badge>

Workspace security controls protect **Orq.ai** workspaces with verified domains and approved network ranges. Only workspace admins can manage these settings.

Navigate to **Settings > Organization > Security**.

## Domains

Verify domain ownership with a DNS TXT record. Each domain remains pending until **Orq.ai** finds the required record.

<Steps>
  <Step title="Add a domain">
    Select <kbd><Icon icon="plus" /> Domain</kbd>. Enter the root domain. Do not include a protocol or path. Select <kbd>Add domain</kbd>.
  </Step>

  <Step title="Add the TXT record">
    Copy the displayed **TXT host** and **TXT value** to the DNS provider.
  </Step>

  <Step title="Verify the domain">
    Open the <kbd><Icon icon="ellipsis" /></kbd> menu. Select <kbd><Icon icon="eye" /> View TXT details</kbd>. After the DNS record is available, select <kbd>Verify domain</kbd>.
  </Step>
</Steps>

The verification challenge expires after seven days. Add the domain again to create a new challenge after expiration.

To remove a domain, open the <kbd><Icon icon="ellipsis" /></kbd> menu. Select <kbd><Icon icon="trash" color="red" /> <span style={{color:"red"}}>Delete</span></kbd>.

## IP allowlist

Restrict workspace requests to approved IPv4 or IPv6 network ranges. Every listed range applies while the global allowlist is enabled.

The IP allowlist applies only to requests to **Orq.ai** backend APIs. It does not restrict access to the **AI Studio** frontend.

<Warning>
  Add the current network range before enabling the allowlist, or you may lose access to the workspace.
</Warning>

<Steps>
  <Step title="Add an IP range">
    Select <kbd><Icon icon="plus" /> IP range</kbd>. Enter the range in CIDR notation, or select <kbd>Use my current IP</kbd>. Add an optional description.
  </Step>

  <Step title="Choose the CIDR prefix">
    Use `/32` for one IPv4 address. Use `/128` for one IPv6 address.
  </Step>

  <Step title="Enable the allowlist">
    Turn on **Enable allowlist** after all required ranges are present.
  </Step>
</Steps>

Open the <kbd><Icon icon="ellipsis" /></kbd> menu to delete a range. To stop enforcing all ranges without deleting them, turn off **Enable allowlist**.

Domain actions, allowlist changes, and IP range actions are recorded under **Settings > Organization > Audit Logs**.