Enhanced Security

Extra layers of protection for your Ploy account and your organization.

Ploy supports enhanced security options at two levels — your personal account and your organization as a whole. Choose the guide that applies to you.

Why security matters for your Ploy workspace

Regulated industries: If your company is publicly listed or operates in the financial industry, we absolutely recommend enabling all enhanced security requirements for all members.

• Once you connect a custom domain, your site represents your brand and your users' trust. Your security settings should reflect the stakes — a live business domain deserves the same care as any other production system.
• You and your workspace members should maintain good password hygiene at all times — use strong, unique passwords and keep them in a password manager.
• Losing access to your passwords or devices could allow an unauthorized third party to sign in to your Ploy workspace and publish content maliciously on your domain.
• When inviting users, reserve the Admin role for trusted members who understand your site and domain infrastructure and can make informed decisions about it. Invite everyone else as Members — they can edit and publish content but cannot make changes to infrastructure.
• When inviting users, double-check the email domain for typos. An invitation sent to a lookalike domain (e.g. acrne.com instead of acme.com) could land in an inbox you don't control.
• When a member stops collaborating, remove them from the workspace promptly and re-invite only when needed. Define these expectations in an IT or access policy so there's no ambiguity about when access should be revoked.
• When you receive a Ploy workspace invitation email, verify it's from a sender you trust. Don't accept invitations from workspaces you weren't expecting — if in doubt, confirm with your collaborator through a separate channel before clicking anything.
• Ploy takes this responsibility seriously. The tools in this section are here to help you and your organization stay secure — not just at sign-in, but for the actions that matter most.