> ## Documentation Index
> Fetch the complete documentation index at: https://docs.relayhub.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Hub

> Control signups, SSO, allowed domains, and PII redaction

The **Security Hub** is the admin control panel for how people get into your RelayHub instance and how sensitive data is handled. Open it from **Security Hub** in the sidebar (administrators only).

## Signup and User Approval

Two toggles control how new accounts are created:

* **Enable signups**: when off, no one can self-register; admins invite every user
* **Require admin approval**: when on, new signups land in a pending state and an admin must approve them in the User Hub before they can sign in

Pending approvals show as a badge on the **User Hub** sidebar entry.

## Email Domain Whitelist

Restrict signups to your company's email domains. Add one or more domains (for example `yourcompany.com`); anyone registering with an email outside the list is rejected. Leave the list empty to allow any domain (subject to the signup and approval settings above).

## Single Sign-On (SSO)

RelayHub supports OIDC single sign-on with your identity provider (Okta, Entra ID, Google Workspace, and others).

<Steps>
  <Step title="Enter your provider details">
    Expand the SSO section and provide the **Discovery URL**, **Client ID**, and **Client Secret** from your identity provider.
  </Step>

  <Step title="Choose behavior">
    * **Allow password login**: whether users can still sign in with email and password alongside SSO
    * **Auto-provision users**: whether a successful SSO login from an allowed domain creates a RelayHub account automatically
    * **Email domains**: which domains route through SSO
  </Step>

  <Step title="Test, then save">
    Click **Test** to verify the configuration against your provider before saving. Use **Delete** to remove SSO later (asks for confirmation).
  </Step>
</Steps>

## PII Shield

PII Shield redacts personally identifiable information from documents before they enter your knowledge base, so sensitive values never surface in AI answers.

Toggle redaction per entity type. Types include Social Security numbers, phone numbers, email addresses, credit card numbers, account numbers, driver's licenses, passports, routing numbers, credit scores, person names, addresses, dates of birth, and income figures.

<Note>
  Pattern-based types (SSN, phone, email, card numbers, and similar) are enabled by default and very precise. Name, address, date-of-birth, and income detection rely on language analysis and can occasionally redact things that are not PII; they are off by default. Enable them when your documents warrant the stricter posture.
</Note>

## Related Settings

* Multi-factor authentication is covered in [MFA](/administration/settings/mfa)
* User roles and per-user permissions are covered in [Permissions](/administration/user-management/permissions)
* A full record of security-relevant activity lives in the [Audit Hub](/administration/settings/audit-hub)