Settings

Sidebar → Settings — configuration for the entire organization. Available to Admin and Owner. The section is split into 5 tabs:

Where are personal consents (GDPR / Cookie / marketing emails)? These are the user's personal consents, so they live in the User profile (top-right corner → avatar → "Profile"), not in the organization settings. See the "Personal consents and cookies" section below.

#Organization

Basic information about the organization and branding — visible to all staff.

#Advanced branding (Enterprise)

On the Enterprise plan, additionally (requested via support):

• Branded PDF — export with your logo, accent color, and "© Your Company" headers and footers
• Custom email templates — invitations, OTP, and review notifications arrive in your style
• Hide "Powered by Lynkora" in the widget footer and on public pages

#Onboarding

The "Show setup checklist" button reopens the initial setup wizard for new users.

#Spaces

A list of all the organization's spaces with article and member counts. This duplicates the Spaces section for convenient quick access from settings.

A global Admin automatically receives the Admin role in every space.

#Security

#Single Sign-On (SSO)

Available on the Business and Enterprise plans (plan flag allows_sso). On lower plans, the section shows an upgrade prompt.

Corporate authentication via an external provider. Supported:

SAML 2.0 — in development. OIDC authentication is available now.

Setup:

1. Select a provider from the list or Custom OIDC
2. Enter the Client ID + Client Secret
3. Discovery URL — for example https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
4. Test — LiKE checks that the Discovery URL is reachable and contains the required endpoints (a configuration check, not a full sign-in)
5. Enable SSO — after a successful test
6. Mandatory SSO (optional) — disables password login, leaving only SSO

MFA / 2FA — in development. Stronger sign-in via TOTP apps (Google Authenticator, 1Password, Authy) is planned.

#Change password

You can also change your own account password here: current password → new password (minimum 8 characters) → repeat the new one. If you sign in via Google/SSO and never set a password, this block does not apply.

#SCIM 2.0 auto-provisioning (Enterprise) — in development

Planned: automatic creation / deactivation of users and groups through your HR IdP:

• A new employee in the HR system → automatically created in LiKE with the correct role
• Offboarding → automatic deactivation in LiKE and token revocation
• Groups / departments → mapped to LiKE spaces

#Security log

Linked to the Activity log — all security events (sign-in, sign-out, role change, password change) are logged automatically with resource_type=user.

#Domain

Connecting your own domain for the portal instead of the standard <slug>.lynkora.pro.

Why: clients visit docs.yourcompany.com or help.yourcompany.com instead of slug.lynkora.pro — it looks like part of your product, not a third-party service. This is especially important for the widget and the public knowledge base.

#How to connect

1. Enter the domain — for example, docs.yourcompany.com (third-level domain only; the apex yourcompany.com is not supported)
2. Save — the system will show you the CNAME target (example: slug.lynkora.pro)
3. Create a CNAME record at your registrar (Cloudflare / GoDaddy / Namecheap / any other DNS provider):
   • Hostname: docs (or another subdomain you entered)
   • Type: CNAME
   • Target: the value from step 2
   • TTL: Auto (or 300-3600 sec)
4. Verify the domain — click the "Verify" button in LiKE. The system performs a DNS lookup and confirms that the CNAME resolves correctly. On success, the status becomes "Verified".
5. Done — the portal is available at both addresses (docs.yourcompany.com and slug.lynkora.pro), and a Let's Encrypt certificate is issued automatically in the background.

#Possible errors

Available on Business and Enterprise (white-label). On lower plans, the section shows an "Upgrade your plan" prompt.

#Danger zone

This tab contains export of all organization data and irreversible actions.

#Data export

Once ready, the file downloads automatically (an "Export ready" toast appears).

#Irreversible actions

They require double confirmation (typing a phrase or the organization name):

Before deleting the organization — be sure to export important articles via Export articles and download the activity log (if needed for compliance).

#Organization restore (30 days)

After a deletion request, the organization moves to a "scheduled for deletion" state and is kept for another 30 days. Within that period it can be returned to an active state in one of the following ways:

Only the organization's owner (or support) can restore it. After 30 days, restore becomes impossible — the data is deleted for good.

#Personal consents and cookies (outside the Settings tabs)

GDPR consents, cookie scope selection, and marketing consent are the user's personal settings, not organization settings. They live in the User profile (top-right corner → click the avatar → "Profile"):

Cross-device persistence. Cookie consent is stored in the database (users.cookie_consent_*), not in the browser's localStorage. Once you consent, the banner will not appear in incognito, on another device, or after clearing cookies. Works as of PR bf6b1b4 (2026-05-23).

Marketing emails are product news, beta invitations, and surveys. They do not include transactional emails (invitations, OTP, billing notifications) — those are always sent, and GDPR does not prohibit that.

#Publishing to the public knowledge base

There used to be a separate "Public KB" tab, but per ADR 0029 it has been removed. Publishing now works per article / collection via the publish_state field (Draft / Internal / Public).

The full guide is in the Public knowledge base article.