> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings

> Configure your Matproof workspace, API access, integrations, and AI context.

## Overview

Settings is split into personal settings (per user) and organization settings (admin only). Access it via the gear icon in the sidebar or by navigating to `/settings`.

<CardGroup cols={2}>
  <Card title="Personal settings" icon="user">
    Profile, notifications, language — applies only to your account.
  </Card>

  <Card title="Organization settings" icon="building">
    Company info, team members, billing — admin only, applies to the whole workspace.
  </Card>
</CardGroup>

## Profile

**Settings → User**

Update your personal details:

* Display name and profile photo
* Email address (used for notifications)
* **Notification preferences** — choose which events trigger email or in-app notifications (evidence expiry alerts, task assignments, access review reminders)
* **Language** — switch the Matproof interface between English (EN) and German (DE)

## API Keys

**Settings → API Keys**

Generate API keys to access Matproof programmatically — useful for CI/CD pipelines, custom dashboards, or internal tooling.

### Key scopes

| Scope        | What it allows                                                           |
| ------------ | ------------------------------------------------------------------------ |
| `read`       | Read all workspace data: controls, evidence, vendors, people, risks      |
| `read_write` | Read and write — create/update controls, upload evidence, modify records |

<Warning>
  Never commit API keys to source code. Use environment variables or a secrets manager. Read-only keys are sufficient for most integrations — only use read/write when your pipeline needs to push data back to Matproof.
</Warning>

### Creating a key

1. Go to **Settings → API Keys**
2. Click **New API key**
3. Give it a descriptive name (e.g. `ci-evidence-uploader`)
4. Select the scope
5. Copy the key — it is only shown once

### Using the API

Pass the key in the `Authorization` header:

```bash theme={null}
curl https://api.matproof.com/v1/controls \
  -H "Authorization: Bearer YOUR_API_KEY"
```

See the [API Reference](/api-reference) for full endpoint documentation.

## Secrets

**Settings → Secrets**

Store sensitive credentials for use in integrations — API keys, passwords, OAuth tokens. All secrets are encrypted at rest.

Secrets are referenced by name in integration configurations rather than pasting raw credentials. This means credentials are stored once and never exposed in logs or configuration UIs.

**When to use Secrets:**

* Integration credentials that cannot use OAuth
* Webhook signing secrets
* External scanner API keys

<Note>
  Secrets are scoped to your organization. Only Admins and Owners can create or view secrets. Regular users cannot access stored secret values.
</Note>

## Browser Connection

**Settings → Browser Connection**

The Matproof browser extension lets you capture evidence directly from web applications — useful when there is no native integration available.

### Setup

1. Install the [Matproof browser extension](https://chrome.google.com/webstore) from the Chrome Web Store
2. Go to **Settings → Browser Connection**
3. Click **Connect** — this generates a connection token
4. Paste the token in the extension settings

### Capturing evidence

Once connected, navigate to any web app in your browser, click the Matproof extension, and select **Capture screenshot** or **Capture page data**. The evidence is attached to a control of your choice.

<Tip>
  Use the browser extension for SaaS tools that don't have a native Matproof integration — for example, capturing access control settings from a legacy HR system or exporting a compliance report from a third-party tool.
</Tip>

## Context Hub

**Settings → Context Hub**

The Context Hub is where you tell Matproof about your organization. This context is used by Matproof's AI to generate relevant policies, suggest control implementations, and write accurate risk assessments.

### What to add

The more specific you are, the better the AI output:

| Section                  | What to include                                          |
| ------------------------ | -------------------------------------------------------- |
| Company description      | What your company does, industry, size, customer types   |
| Tech stack               | Cloud providers, databases, languages, SaaS tools in use |
| Compliance history       | Past audits, certifications held, known gaps             |
| Data types               | What personal or sensitive data you process              |
| Organizational structure | Team structure, key departments                          |

### Example entry

```
We are a 35-person B2B SaaS company building HR software for mid-market companies
in the DACH region. We process employee personal data (names, salaries, performance
reviews) for around 200 business customers. We run on AWS (eu-central-1), use
PostgreSQL on RDS, deploy via GitHub Actions, and use Slack, Notion, and Linear
internally. We completed a voluntary ISO 27001 readiness assessment in 2024.
```

<Tip>
  Fill in the Context Hub before generating your first policies. A well-described context hub dramatically improves the relevance of AI-generated policy drafts.
</Tip>

## Organization Settings

**Admin only**

| Setting        | Description                                                 |
| -------------- | ----------------------------------------------------------- |
| Company name   | Displayed on exported reports and auditor-facing documents  |
| Logo           | Used on policy documents and the auditor portal             |
| Timezone       | Affects timestamps on evidence and scheduled task reminders |
| Data residency | Choose where your compliance data is stored (EU / US)       |

Changes to organization settings take effect immediately across the workspace.