This article lists the Perplexity Enterprise settings that support a FedRAMP 20x-aligned secure configuration, for organization administrators at government agencies. Each recommendation names the control, why it matters, and where to find it.
Retention policies and audit logging are available to Enterprise organizations with 50 or more seats, or with at least one Enterprise Max seat.
Before you start
You need an organization administrator role, or a custom role with the relevant permissions. See Introduction to organization admins and User management for Enterprise organizations.
For SSO and SCIM, you need administrator access to your agency’s identity provider.
If your organization is new to Perplexity Enterprise, complete the Perplexity Enterprise onboarding guide first.
Recommended configuration
For FedRAMP 20x-aligned secure configuration, Perplexity recommends centralizing identity through SSO, managing user lifecycle through your identity provider, restricting external sharing, applying file and retention controls, and enabling audit logging.
Use Single Sign-On (SSO)
Perplexity recommends enabling and enforcing SSO for Enterprise organizations, and verifying your domains, so authentication is managed through your agency’s identity provider. SSO helps centralize access control, support domain-based restrictions, and reduce reliance on standalone passwords. For setup steps, see SSO Integration: Getting Started.
Go to Organization Settings → Identity.
Manage users through your identity provider
Where available, use SCIM to keep user access aligned with your agency directory. This helps automate onboarding, role assignment, and deprovisioning as users join, move, or leave the organization. See Account Management for SSO, SCIM-based user account management, and Managing users and access control.
Go to Organization Settings → Identity.
Limit public sharing
Perplexity recommends disabling public sharing for sessions and Pages unless your agency has explicitly approved those use cases. Projects cannot be shared by public link. The Allow public project sharing toggle controls whether members can invite people outside your organization to Projects; turn it off to keep Projects organization-only. Project access is otherwise limited to invited members, organization access, and approved join requests. Keeping sharing organization-only helps reduce the risk of sensitive information being exposed outside the agency environment. The Allow public session sharing, Allow public page sharing, and Allow public project sharing settings are described in Enterprise roles and permissions.
Go to Organization Settings → Data and privacy.
Restrict file actions
Perplexity recommends limiting members’ ability to download files or attach files to sessions unless required for an approved workflow. These controls help reduce unnecessary movement of sensitive data and keep file handling under administrator oversight. The Download files and Attach files to sessions permissions are described in Enterprise roles and permissions.
Go to Settings → Organization → Roles & Permissions.
Use approved connectors only
Perplexity recommends enabling only the third-party connectors your agency has reviewed and approved. Connector settings let administrators control access to services such as Google Drive, OneDrive, SharePoint, Slack, Jira, GitHub, and other integrated applications, and set whether newly launched connectors are enabled by default. See Enterprise roles and permissions.
Go to Organization Settings → Connectors.
Keep model providers enabled by default
Perplexity recommends keeping the standard Enterprise model provider configuration enabled unless your agency has a specific policy restriction. This preserves access to the Enterprise model set while still allowing administrators to align model availability with internal requirements. See Data retention and privacy for Enterprise organizations.
Go to Organization Settings → Data and privacy.
Enable API access only when needed
Perplexity recommends enabling API access only for approved agency use cases, such as sanctioned development or integration workflows. Review API access before enabling it, and limit it to users or teams with a documented need. The Perplexity API access permission is described in Enterprise roles and permissions.
Go to Settings → Organization → Roles & Permissions.
Configure retention and history settings
Perplexity recommends configuring session retention to match your agency’s records, privacy, and compliance requirements. Administrators can turn on Enforce Incognito Mode and set a retention period for sessions. For how retention is measured and what happens to sessions outside the retention period, see Data Retention for Enterprise.
Go to Organization Settings → Data and privacy.
Enable audit logging
Perplexity recommends enabling audit logs for organizations that need activity monitoring and compliance evidence. Audit logs capture queries, file uploads, and organization settings changes, and are delivered to a webhook endpoint you configure. See Audit Logs for setup and event types, and Enterprise usage analytics for usage monitoring.
Go to Organization Settings → Data and privacy, then under Audit Log Settings select Enable Audit Logging.
Security and compliance
Perplexity Enterprise and API Platform is FedRAMP Certified under the FedRAMP 20x program at the Low impact level (Class B), listed on the FedRAMP Marketplace as of February 1, 2026. For the authorization package, compliance certifications, sub-processor list, and data-handling documentation, visit the Trust Center.