Workspace gates, feature flags, data operations and mobile operations

The Administration group of the sidebar holds the workspace controls that are not about detection: optional product behaviours, visitor experiments, deleting browser data and mobile posture. This page also covers your own Settings page and the notifications panel. A workspace Admin uses most of these pages; Analysts can read Feature Flags.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

Sign-in, SSO and MFA enforcement are on Sign-in & Access, covered in Sign-in, SSO, SCIM, MFA and IP allowlist. Users and roles are in Roles and permissions. The audit log and exports are in Audit log and data export.

Prerequisites

• The role in the table. See Backoffice guide.
• An authenticator app. Gates, flags, data operations and the mobile key each ask for a fresh MFA check.
• For Feature Flags: at least one registered domain. See Domains, site keys and the install card.
• For Data Operations: a clear reason for each deletion and the identifiers to match (device IDs, user ID, domain or dates).

Steps

1. Review Workspace Gates

Open Administration → Workspace Gates. The page lists the gates your workspace can govern. These are product preferences, not legal assertions; assertions live in the Legal basis register.

For each gate you see its state (On or Off), whether this workspace overrides the platform default, and a note headed What this switch does not stop. Read that note: some gates change the Backoffice side of a feature while collection stays on the platform side.

• Turn on: some gates need an acknowledgement, and some also need you to type the gate key. Backoffice re-checks both on the server.
• Turn off and Use platform default: one click, no extra confirmation. Both still need a fresh MFA check and are audited.
• Every change is recorded in the audit log.

If no gate is controllable, the page says so.

2. Create a Feature Flag

Open Administration → Feature Flags. A flag controls a visitor experience on one domain, splits traffic for an experiment, or provides a key for conditional session recording.

1. Pick a domain, then select New flag.
2. Flag key: lowercase letters, numbers, dots, underscores or dashes. The key cannot change later.
3. Description: up to 500 characters.
4. Rollout percentage: the share of identified visitors admitted, from 0 to 100 with up to four decimals. Anonymous visitors always receive the default variant.
5. Experiment variants (optional): up to eight, each with a key and an allocation. Allocations must total 100 percent. Leave variants empty for a Boolean flag.
6. Default variant: what anonymous visitors and out-of-rollout visitors receive.
7. Enabled: allows assignment only when platform delivery is armed. Select Create flag.

On a flag’s page you see State, Identified rollout, 30-day exposures and Reaching anyone, the configured and observed split, and Pinned subjects. To pin a subject to a variant, enter the same email or user ID your integration sends; only a one-way hash is stored. Use the exact flag key in a conditional-recording trigger.

If the page says “Flag delivery is not armed”, definitions are saved but visitors receive no assignments until Noxtica arms delivery for your workspace. Creating and changing flags needs the Admin role and an MFA check. Deleting a flag removes its variants and pins.

3. Run a Data Operation

Open Administration → Data Operations. Tabs: End-User Data, Retention, Admin Accounts, History. Every operation follows three steps: Preview, Review impact, Confirm.

• End-User Data soft-deletes browser intelligence data for chosen devices or users. Match by device IDs (one per line, up to 500), an external user ID, a domain or a date range. Add a reason, which goes to the audit log. Select Preview Impact and read the counts of fingerprints, events and visits.
• Retention triggers a manual retention cleanup of data older than your configured retention period. The page notes that an automatic retention run also happens daily at 03:00 UTC.
• Admin Accounts soft-deletes an operator, who can then no longer sign in. A reason is required.
• Type DELETE in capitals to unlock Confirm Soft Delete. Data is hidden from views and exports, and a platform superadmin can hard-delete it later. The History tab lists every run with its type, status and counts. A run that reaches the per-run row cap is marked Partial; run it again with tighter filters.

Data Operations applies to browser intelligence data. It does not apply to identity verification details or evidence. Noxtica does not remove those on a schedule; a tenant administrator removes them in Backoffice → Identity Verification → KYC Verifications (Delete verification and Delete selected) or through KYC Erasure. See Verification data: storage, access and deletion.

4. Read Mobile Operations

Open Administration → Mobile Operations. It shows Fleet posture and Tenant posture for these capabilities: Mobile kill switch, Secure app handoff, Transactional activation, Account deletion, Android minimum version and iOS minimum version. The page is read-only except for one control.

The kill switch has two keys: a fleet key that Noxtica operators control and a tenant key you control. Mobile access is killed only when both are on. Under Tenant kill-switch control, enter a Change reason (1 to 500 characters), then select Arm tenant kill-switch key or Disarm tenant kill-switch key, and confirm with MFA. If your key is armed, the page cannot observe the fleet key, so the effective posture shows as unknown rather than killed. Registered mobile apps and attestation results are covered in Device and app attestation.

5. Set your own account preferences

Open Settings (shortcut G then S). The page follows your account, not the workspace.

• Security: turn on two-step sign-in with an authenticator app, manage backup codes and review where you are signed in.
• Appearance: theme (Dark, Light, High contrast), density (Compact, Comfortable, Spacious) and interface font (Sans, Mono, Humanist, Mixed).
• Notifications: Critical device email (email when a device exceeds the configured risk threshold), Weekly digest (summary every Monday at 09:00 workspace time) and In-app alerts.
• Privacy & cookies: Noxtica’s own security script always runs on the console to protect sign-in. Analytics, session replay and device recognition for your own console use are your choice and are off until you allow them.

The bell in the top bar opens Notifications: recent audit activity and destructive actions. Workspace-level alerts and reports are on Integrations and API pages.

Verify it works

• A changed gate shows its new state and “Turned on for this workspace.” or “Turned off for this workspace.”, and an audit entry appears.
• A new flag appears in the list with its State; after delivery is armed and traffic arrives, 30-day exposures grow.
• After a data operation, History shows the run as Completed.
• After arming or disarming the tenant kill-switch key, the page shows its confirmation message and the tenant key state changes.
• Your notification choices stay after you reload Settings.

Troubleshooting

Related

• Backoffice guide: navigation, roles and shortcuts: where these pages sit.
• Audit log and data export: every change here is audited.
• Data retention, raw IP storage and data locations: retention settings.
• Data subject scope, erasure requests and account deletion: erasure workflows.
• Verification data: storage, access and deletion: identity data lifecycle.
• Sign-in, SSO, SCIM, MFA and IP allowlist: MFA and SSO.