---
title: "Workspace gates, feature flags, data operations and mobile operations"
description: "Use Workspace Gates, visitor Feature Flags, Data Operations, Mobile Operations and your personal Settings and Notifications in Backoffice, with the roles and MFA checks each needs."
canonical_url: "https://noxtica.com/docs/backoffice/workspace-settings/"
markdown_url: "https://noxtica.com/docs/backoffice/workspace-settings/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "backoffice"
section_title: "Backoffice Guide"
site: "Noxtica"
language: "en"
source: markdown
---

# Workspace gates, feature flags, data operations and mobile operations

The **Administration** group of the sidebar holds the workspace controls that are not about detection: optional product behaviours, visitor experiments, deleting browser data and mobile posture. This page also covers your own **Settings** page and the notifications panel. A workspace Admin uses most of these pages; Analysts can read Feature Flags.

## What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

| Page | Route | Minimum role | Purpose |
| --- | --- | --- | --- |
| Workspace Gates | `/administration/workspace-gates` | Admin | Turn optional product behaviours on or off for this workspace |
| Feature Flags | `/feature-flags` | Analyst to read, Admin to change | Per-domain visitor experiences, experiment splits, conditional-recording keys |
| Data Operations | `/data-operations` | Admin | Soft-delete end-user browser data, run retention, remove admin accounts |
| Mobile Operations | `/mobile-operations` | Admin | Read mobile posture; arm or disarm the workspace's mobile kill-switch key |
| Settings | `/settings` | Any signed-in role | Your own sign-in security, appearance, notifications and privacy choices |

Sign-in, SSO and MFA enforcement are on **Sign-in & Access**, covered in [Sign-in, SSO, SCIM, MFA and IP allowlist](https://noxtica.com/docs/security/sign-in-and-access/). Users and roles are in [Roles and permissions](https://noxtica.com/docs/security/roles-and-permissions/). The audit log and exports are in [Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/).

## Prerequisites

- The role in the table. See [Backoffice guide](https://noxtica.com/docs/backoffice/overview/).
- An authenticator app. Gates, flags, data operations and the mobile key each ask for a fresh MFA check.
- For Feature Flags: at least one registered domain. See [Domains, site keys and the install card](https://noxtica.com/docs/backoffice/domains/).
- For Data Operations: a clear reason for each deletion and the identifiers to match (device IDs, user ID, domain or dates).

## Steps

### 1. Review Workspace Gates

Open `Administration → Workspace Gates`. The page lists the gates your workspace can govern. These are product preferences, not legal assertions; assertions live in the [Legal basis register](https://noxtica.com/docs/compliance/legal-basis/).

For each gate you see its state (**On** or **Off**), whether this workspace overrides the platform default, and a note headed **What this switch does not stop**. Read that note: some gates change the Backoffice side of a feature while collection stays on the platform side.

- **Turn on**: some gates need an acknowledgement, and some also need you to type the gate key. Backoffice re-checks both on the server.
- **Turn off** and **Use platform default**: one click, no extra confirmation. Both still need a fresh MFA check and are audited.
- Every change is recorded in the audit log.

If no gate is controllable, the page says so.

### 2. Create a Feature Flag

Open `Administration → Feature Flags`. A flag controls a visitor experience on one domain, splits traffic for an experiment, or provides a key for conditional session recording.

1. Pick a domain, then select **New flag**.
2. **Flag key**: lowercase letters, numbers, dots, underscores or dashes. The key cannot change later.
3. **Description**: up to 500 characters.
4. **Rollout percentage**: the share of identified visitors admitted, from 0 to 100 with up to four decimals. Anonymous visitors always receive the default variant.
5. **Experiment variants** (optional): up to eight, each with a key and an allocation. Allocations must total 100 percent. Leave variants empty for a **Boolean flag**.
6. **Default variant**: what anonymous visitors and out-of-rollout visitors receive.
7. **Enabled**: allows assignment only when platform delivery is armed. Select **Create flag**.

On a flag's page you see **State**, **Identified rollout**, **30-day exposures** and **Reaching anyone**, the configured and observed split, and **Pinned subjects**. To pin a subject to a variant, enter the same email or user ID your integration sends; only a one-way hash is stored. Use the exact flag key in a conditional-recording trigger.

If the page says "Flag delivery is not armed", definitions are saved but visitors receive no assignments until Noxtica arms delivery for your workspace. Creating and changing flags needs the Admin role and an MFA check. Deleting a flag removes its variants and pins.

### 3. Run a Data Operation

Open `Administration → Data Operations`. Tabs: **End-User Data**, **Retention**, **Admin Accounts**, **History**. Every operation follows three steps: **Preview**, **Review impact**, **Confirm**.

- **End-User Data** soft-deletes browser intelligence data for chosen devices or users. Match by device IDs (one per line, up to 500), an external user ID, a domain or a date range. Add a reason, which goes to the audit log. Select **Preview Impact** and read the counts of fingerprints, events and visits.
- **Retention** triggers a manual retention cleanup of data older than your configured retention period. The page notes that an automatic retention run also happens daily at 03:00 UTC.
- **Admin Accounts** soft-deletes an operator, who can then no longer sign in. A reason is required.
- Type `DELETE` in capitals to unlock **Confirm Soft Delete**. Data is hidden from views and exports, and a platform superadmin can hard-delete it later. The **History** tab lists every run with its type, status and counts. A run that reaches the per-run row cap is marked **Partial**; run it again with tighter filters.

Data Operations applies to browser intelligence data. It does not apply to identity verification details or evidence. Noxtica does not remove those on a schedule; a tenant administrator removes them in `Backoffice → Identity Verification → KYC Verifications` (**Delete verification** and **Delete selected**) or through `KYC Erasure`. See [Verification data: storage, access and deletion](https://noxtica.com/docs/identity-verification-data/).

### 4. Read Mobile Operations

Open `Administration → Mobile Operations`. It shows **Fleet posture** and **Tenant posture** for these capabilities: **Mobile kill switch**, **Secure app handoff**, **Transactional activation**, **Account deletion**, **Android minimum version** and **iOS minimum version**. The page is read-only except for one control.

The kill switch has two keys: a fleet key that Noxtica operators control and a tenant key you control. Mobile access is killed only when both are on. Under **Tenant kill-switch control**, enter a **Change reason** (1 to 500 characters), then select **Arm tenant kill-switch key** or **Disarm tenant kill-switch key**, and confirm with MFA. If your key is armed, the page cannot observe the fleet key, so the effective posture shows as unknown rather than killed. Registered mobile apps and attestation results are covered in [Device and app attestation](https://noxtica.com/docs/security/attestation/).

### 5. Set your own account preferences

Open `Settings` (shortcut `G` then `S`). The page follows your account, not the workspace.

- **Security**: turn on two-step sign-in with an authenticator app, manage backup codes and review where you are signed in.
- **Appearance**: theme (Dark, Light, High contrast), density (Compact, Comfortable, Spacious) and interface font (Sans, Mono, Humanist, Mixed).
- **Notifications**: **Critical device email** (email when a device exceeds the configured risk threshold), **Weekly digest** (summary every Monday at 09:00 workspace time) and **In-app alerts**.
- **Privacy & cookies**: Noxtica's own security script always runs on the console to protect sign-in. Analytics, session replay and device recognition for your own console use are your choice and are off until you allow them.

The bell in the top bar opens **Notifications**: recent audit activity and destructive actions. Workspace-level alerts and reports are on [Integrations and API pages](https://noxtica.com/docs/backoffice/integrations/).

## Verify it works

- A changed gate shows its new state and "Turned on for this workspace." or "Turned off for this workspace.", and an audit entry appears.
- A new flag appears in the list with its **State**; after delivery is armed and traffic arrives, **30-day exposures** grow.
- After a data operation, **History** shows the run as **Completed**.
- After arming or disarming the tenant kill-switch key, the page shows its confirmation message and the tenant key state changes.
- Your notification choices stay after you reload **Settings**.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| No gates are listed | No gate is currently controllable per workspace | None; check back after a product update |
| A gate will not turn on | It needs an acknowledgement or the typed key | Complete the dialog |
| Flag assignments never reach visitors | Platform delivery is not armed, the flag is disabled, or rollout is 0 | Check the notices on the page; ask your account team |
| "Variant allocations must total 100%" | Allocations do not add up | Adjust them to total 100 |
| Preview Impact is disabled | No filter is set | Add device IDs, a user ID, a domain or dates |
| Too many device IDs | More than 500 IDs in one run | Split the run |
| Confirm button stays locked | `DELETE` was not typed exactly in capitals | Retype it |
| A run is marked Partial | It reached the per-run row cap | Run again with tighter filters |
| The kill-switch buttons are greyed out | No change reason entered | Enter a reason of 1 to 500 characters |
| Mobile page asks you to switch tenant scope | A platform operator has no workspace selected | Select a workspace |

## Related

- [Backoffice guide: navigation, roles and shortcuts](https://noxtica.com/docs/backoffice/overview/): where these pages sit.
- [Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/): every change here is audited.
- [Data retention, raw IP storage and data locations](https://noxtica.com/docs/compliance/retention-and-locations/): retention settings.
- [Data subject scope, erasure requests and account deletion](https://noxtica.com/docs/compliance/requests-and-deletion/): erasure workflows.
- [Verification data: storage, access and deletion](https://noxtica.com/docs/identity-verification-data/): identity data lifecycle.
- [Sign-in, SSO, SCIM, MFA and IP allowlist](https://noxtica.com/docs/security/sign-in-and-access/): MFA and SSO.