Records and security

Secure your organization

Mask personal data on cards, limit access by IP, seal sensitive fields with your own key, and turn on single sign-on.

About 10 minutes

Transcript (30 seconds)

Control what approvers see and who can get in.

Mask personal data on every card.

Limit the dashboard and API to your networks.

Seal sensitive fields with your own key.

Turn on single sign-on once for every product.

Before you start

An owner role
Sealed context needs the Enterprise plan; SSO and SCIM need Business or Enterprise

Mask personal data
Under Org security, turn masking on. Cards hide card numbers, SSNs, phone numbers and emails; approvers see full values in the inbox after a passkey check.
Limit access by IP
Add your ranges in CIDR form. The dashboard, API and MCP server refuse other addresses. You cannot save a list that locks you out.
Seal sensitive fields
Agents encrypt fields with your key. promptcompute stores only ciphertext; approvers' browsers open it through your codec endpoint.
```
import { seal } from "@promptcompute/sdk";

args: { amount: 120, customer: { ssn: await seal("123-45-6789", process.env.SEAL_KEY!, "k1") } }
```

Run the open-source codec server inside your network and paste its URL. The token secret is shown once.

CODEC_KEYS="k1:<base64 key>" CODEC_TOKEN_SECRET="<from Org security>" \
CODEC_ALLOWED_ORIGINS="https://app.promptcompute.ai" npx @promptcompute/codec

Turn on SSO and SCIM
Set up single sign-on and SCIM once in PromptReports ID; it covers promptcompute and the other products. People removed in your directory lose access.

The situation: Refund cards in Slack show customer emails.
What to do: Turn masking on.
What happens: Slack shows d***@example.com; the full value stays in the inbox behind a passkey.

The situation: Requests carry account numbers your security team will not send to a vendor.
What to do: Seal those fields and run the codec server in your network.
What happens: promptcompute never sees the values; approvers still read them in the inbox.

Every setting change is in the signed ledger, and cards show only what your settings allow.

It worked when

Example output: A masked card

Refund $120 for d***@example.com
Card: **** **** **** 4242
Some values are sealed with your key; open Details to see them

Your address is not in the list: Add your current address first; the page shows it. Saving refuses a list that would lock you out.
Sealed values do not open: The codec server must allow CORS from the app's origin and hold the key id the agent used.
SSO setup is missing: SSO lives in PromptReports ID. If it is not turned on for your deployment, ask the operator.