Check your security on the Security page

What it is

The Security page, under Settings, shows a Security checklist for your business with a score, such as 5 of 7 checks passed. Each check is worked out from your own team, API keys and settings, explained in one plain sentence, and comes with a button that opens the page where you fix it. Below the checklist you set auto sign-out, and a section called Everything in one place links to every other security setting where it already lives.

Why it helps

Security settings live in several places: Team, Privacy & security and API & monitoring. This page puts them side by side, shows what needs attention first, and turns each gap into one tap. Owners and admins can open it.

How to use it

1. 1Open Settings, then Security. The Security checklist at the top shows your score, for example 5 of 7 checks passed, and how many things are left to fix.
2. 2Read each check. A tick means it passes and a warning sign means it needs attention. Each one that you can fix has a button that opens the right page, such as Require it, See who, Turn on yours, Add a passkey, Review keys, Review access or Turn it on.
3. 3The checks are: two-step login required for the team, everyone on the team using two-step login, owners and admins using two-step login, owners and admins having a passkey or two-step login, API keys that have never been used or not used in 90 days, keys and connected apps that can change things rather than only read, keys or apps left behind by people no longer on your team, everyone on the team having signed in within 90 days, and auto sign-out. The checks about keys and apps only appear when your business has some. The sign-in check appears from late January 2027, once Bookatu has 90 days of sign-ins to look at; people who joined in the last 90 days are not counted.
4. 4If you are an admin, some fixes are the owner's alone. Instead of a button you see who can make the change, for example Only the owner can change this, on Team > Two-step.
5. 5Set Auto sign-out after inactivity in its own card on the same page. It is off until someone turns it on.
6. 6Scroll to Everything in one place for links to two-step login for you and your team, passkeys, role permissions, the Audit log, API keys and connected apps, and your data. Each opens where it already lives. For an admin, the ones only the owner can open are named but not linked.