Two-factor authentication for a Notion law practice

Where two-factor authentication lives

Because the template is duplicated into your own Notion workspace, every sign-in goes through Notion. MatterOS cannot see who logs in and cannot enforce a second factor. That is a design choice: your data stays in your workspace, and I never see it.

A security checklist for a MatterOS workspace

1. Turn on Notion two-step verification for your own account and store the recovery codes somewhere other than the same device.
2. Ask every colleague and assistant to do the same before you invite them to the workspace.
3. If your plan supports single sign-on, ask your identity provider whether it can enforce a second factor centrally. Availability depends on your Notion plan, so check Notion's current plan details.
4. Open the Matters, Evidence and Clients databases and check who has access, including guests and any public share links.
5. Remove access when someone leaves, and review the member and guest lists on a fixed date each quarter.

• Notion: two-step verification

Sensitive matters need an extra layer of thought

Two-step verification protects the sign-in, not the content. For sensitive matters, keep the Evidence register to references (document name, classification, status) and keep the documents themselves in the storage your firm already trusts. Decide which categories of client information, if any, you are comfortable holding in Notion at all.

Our security page explains what MatterOS is and is not responsible for.

• MatterOS security
• Evidence tracking in Notion

What to tell clients

Not legal advice. Check the rules that apply in your jurisdiction. If a client or insurer asks about authentication, answer from Notion's documentation and your own settings, not from the template.

Frequently asked questions

Does MatterOS have two-factor authentication?

No. MatterOS is a Notion template with no login of its own. Use Notion's two-step verification.

Where do I turn on two-step verification in Notion?

In your Notion account settings. Notion's help article on two-step verification gives the current steps.

Does two-step verification protect guests I share a matter with?

Only for their own accounts. Review guest access and share links separately.

Is Notion enough for client confidentiality?

That depends on your jurisdiction, your clients and your insurer. Check your professional rules and Notion's security documentation.