Enterprise controls

Everything on this page is part of the Enterprise plan. See pricing for what's included at each tier. These controls live in the dashboard: single sign-on under Settings → Security, data subject requests under Settings → Data requests, reconciliation under Settlement, and scheduled exports/anomaly alerts under Automation.

Single sign-on (SAML)

Prove you control an email domain, then connect your identity provider to it. An organization can prove up to 10 domains and connects exactly one provider, which answers for all of them.

To prove a domain, add it under Settings → Security and publish the TXT record we show you. Until it resolves, nobody can route sign-ins for the domain. Press Check DNS once it's live. Keep the record in place after verification: it is the ongoing proof that the domain is yours, and if it disappears while another organization can prove control of the same domain, they can take over routing for it. That is why the dashboard keeps showing it.

Once at least one domain is verified, connect your identity provider with its SAML metadata: a URL (Okta publishes one) or the XML file (Entra ID and ADFS usually give you a download). The provider answers for every verified domain, including domains you verify later. Removing your last verified domain disconnects the provider too.

Disconnecting the provider keeps your verified domains, so moving from Okta to Entra ID means reconnecting with new metadata, not republishing TXT records.

Connecting or disconnecting SSO does not end existing sessions. SSO does not replace password sign-in: it is a separate route (/login/sso, where someone enters their organization's domain) alongside your normal login.

The first time someone signs in through your identity provider, they join your organization's roster with no role. Your IdP decides who is an employee; your organization's owner grants roles. If that person already had an account (a password signup from before SSO, or a pending invite under the same address), their existing membership moves to the SSO identity instead of being duplicated, but only when the address is under a domain you have verified. Only your organization's owner can claim domains or connect and disconnect a provider.

Data subject requests (GDPR/CCPA)

Under Settings → Data requests, identify a person by one handle (email, user ID, or author ID) and either export everything held about them or erase their footprint in your organization. We cross-reference your team and contributor records from that handle, so data under another handle for the same person, such as a changed email, is included.

Export downloads a JSON package: organization memberships, contributor memberships, role grants, the tenants they own, their scheduled exports and anomaly alerts, gating decisions logged against them within your tenants, and the audit events where they were the actor, all scoped to your organization. Scheduled exports and alerts are included only when the person owns no sites outside your organization, for the reason given under Erasure below; otherwise the package says they were withheld. Export is read-only and needs no confirmation.

Erasure is destructive; you confirm by typing the handle back. It removes their non-owner organization memberships, contributor memberships, role grants, and the gating decisions logged against them in your tenants. It also removes their scheduled exports and anomaly alerts, but only if they own no tenants outside your organization: those are not stored per organization, so we leave them alone when they are shared with another organization, and the response says so.

Four things are never erased:

• the audit trail, kept as the accountability record under legal obligation;
• financial and settlement records, which are keyed by wallet, not person, and kept for accounting and tax;
• gating decisions not tied to one of your tenants, kept as an operational and security log;
• the login account itself.

So erasure ends the person's relationship with your organization. It does not close their naulon account.

Every export and erasure is recorded in your audit log when it runs. An erasure's audit row carries only counts of what was removed, never the person's data. There is no review queue: both run immediately.

Reconciliation

Under Settlement → Reconciliation. The earnings shown elsewhere are the primary author's cut, which settles when the read is paid for. Reconciliation covers the other legs of the same payment, an operator fee or a co-author cut, which settle separately on a drain. It groups them as settled, outstanding (inside the authorization window, in flight), and expired (the window passed unsettled, so the buyer was never charged: uncollected revenue, not a debt). "Books balanced" means zero outstanding and zero expired.

Reconciliation compares naulon's recorded settlement state with its own ledger; it does not query the chain. "Settled" means our drain marked the leg handed off exactly once.

The audit log

The Activity log page is the compliance trail of authenticated actions across your organization: who changed a config, invited or removed a teammate, deleted a site, connected an identity provider, and so on. Anyone with access to the page sees every member's actions.

It exports as CSV (every column, for an auditor) or PDF (a filing copy capped at 1,000 rows, with a note pointing to the CSV when it's clipped). The trail is append-only: entries are never edited, only removed once the retention period passes. That period is 365 days and is separate from your plan's dashboard history, so changing your subscription never shortens it. On Enterprise it is unlimited.

Automation: scheduled exports and anomaly alerts

Two independent registers on the Automation page.

A scheduled export delivers either the CSV earnings export or the PDF payout statements by email, on a daily, weekly, or monthly cadence, scoped to all your sites or one. Each delivery covers a trailing window you choose separately from the cadence, for example a weekly email covering the last 30 days.

An anomaly alert fires on one of three conditions, evaluated over a window you set (from the last 24 hours out to lifetime): earnings below a dollar threshold, zero earnings at all, or denied requests above a count. After it fires, it fires at most once per window length (once a day for a lifetime window), so a standing problem doesn't repeat on every check.

A scheduled export arrives by email with its file attached. An anomaly alert arrives by email and also fires the anomaly.detected webhook if you have an endpoint for it; see Webhooks. Webhooks are free on every plan; the alert and export rules that trigger them are Enterprise.