Enterprise controls are security-sensitive. Use them only when the agency has an operational need and someone responsible can monitor them.
API credentials
Create scoped, revocable API credentials for integration work. Choose only the scopes needed, set an expiration, and store the secret in a secret manager.
The secret is shown once. Revoke a credential immediately if it is exposed or no longer needed.
Webhooks
Use outbound webhooks to send selected state events to agency systems. Configure a public HTTPS endpoint, choose event types, and verify signatures with the signing secret.
Rotate webhook secrets when needed and revoke endpoints that are no longer monitored.
Retention and legal hold
Retention controls define how long organization data should be retained within supported limits. Legal hold should be used only for a real agency legal or compliance reason.
Changing retention does not replace the agency's own legal obligations. Coordinate with counsel or compliance owners for client data requests.
Support access
Support access should be requested for a specific reason, scope, and time window. Owners should approve only when the access is necessary.
Reject requests that are too broad, unclear, or not tied to an active support issue.
Exports
When organization exports are enabled, an owner or admin can request a private ZIP archive from the agency workspace. Platix builds the archive asynchronously, keeps it available for a limited time, and authorizes each download through the signed-in agency account.
The archive can contain agency, client, trip, proposal, and approved organization-file data. It intentionally excludes credentials, security telemetry, internal audit records, and members' personal Platix content. Treat every downloaded archive as sensitive: store it securely, restrict access, and delete local copies when they are no longer needed.