Skip to main content
The Security screen controls how people get access to your RelayHub instance and how RelayHub protects sensitive data. Open the Admin group in the sidebar and click Security. Only admins see this screen.

​
New User Signup

The New User Signup switch controls the registration from the sign-in page. When you turn it off, RelayHub hides the signup link and blocks new registrations. Admins can still invite users from People.

​
New Users Require Admin Approval

When you turn on New Users Require Admin Approval, each new signup must get admin approval before RelayHub sends the verification email. Users that an admin invites do not need approval. A signup that waits for approval has the status Pending Approval in People. A number badge on the People item in the sidebar shows how many signups wait. See Managing Users.

​
Allowed Email Domains

Use Allowed Email Domains to limit the registration to your email domains.
  1. Type a domain, for example company.com.
  2. Click Add.
When the list has domains, only email addresses in these domains can register. When the list is empty, any email address can register. To remove a domain, click the Remove domain icon next to it.

​
Single Sign-On (SSO)

RelayHub supports single sign-on with OpenID Connect (OIDC). Click Single Sign-On (SSO) to open the section. The status shows Not Configured, Configured, or Enabled.
1

Enter the identity provider details

Under OIDC configuration, enter the OpenID Connect Discovery URL, the Client ID, and the Client Secret from your identity provider. Add the Email Domains that use SSO.
2

Set the behavior

Under Behavior settings, set these switches:
  • Allow password login as fallback: users can still sign in with email and password. Turn it off to make SSO the only sign-in method.
  • Auto-provision new users on first SSO login: RelayHub makes an account for a new user at the first SSO sign-in.
3

Add the callback URL to your identity provider

Under Generated information, copy the Callback URL. Add it to the allowed redirect URIs of your identity provider.
4

Test and save

Click Test Connection to check the configuration. Then click Save Configuration.
5

Turn on SSO

After you save the configuration, use the switch to turn on SSO. The text SSO is Enabled shows when users can sign in with the identity provider.
To remove SSO, click Delete Configuration and confirm.

​
PII Shield

PII Shield finds sensitive data in chat and tool requests. It replaces the data with tokens before the request goes to the AI model. Click PII Shield to open the section, then use the switch to turn it on. Under Protected entity types, turn each type on or off:
  • Social Security Numbers, Phone Numbers, Email Addresses, Credit Card Numbers, Account Numbers
  • Driver’s License Numbers, Passport Numbers, Bank Routing Numbers, Credit Scores
  • Person Names, Physical Addresses, Dates of Birth, Income / Salary
When you first turn on PII Shield, the number and pattern types are on. Person Names, Physical Addresses, Dates of Birth, and Income / Salary are off. These four types use language analysis and can mark text that is not personal data, for example company names or revenue figures. Context-Aware Detection uses the text near a value to prevent false matches. For example, it can tell a date of birth from a publication date. The Audit summary (last 30 days) shows how many values PII Shield replaced.
PII Shield does not protect all data. RelayHub sends document text to the provider without the shield for the knowledge graph and for search. PII Shield does not change images. If the detection fails, RelayHub sends the text without tokens.