# Freeze a Workspace

Freezing is an emergency "kill switch" that lets an admin instantly halt all
activity in your workspace from a single action. Use it to contain an incident —
a suspected key compromise, a phishing event affecting a signer, abnormal
automation behavior, or an insider threat — without having to disable users,
revoke tokens, and pause automation one surface at a time.

Freezing is deliberately asymmetric: a single admin can freeze immediately, but
releasing the freeze requires both Fordefi Customer Success and an Admin Quorum
approval. This makes it hard for an attacker to silently reverse the
containment.

## Workspace states

A workspace is in one of three states:

- **Active**: The normal state. All actions are available.
- **Frozen**: Every value-moving and configuration-changing action is blocked.
- **Pending unfreeze**: A release has been started and is awaiting Admin Quorum
approval. The workspace stays frozen until the quorum approves.


## What freezing does

While a workspace is frozen, all value-moving and configuration-changing actions
are blocked, including:

- New transactions and swaps
- Approvals and signatures on already-pending transactions
- Policy creation, edits, and deletion
- User, role, and API User changes
- Address book changes
- MFA and passkey changes
- Webhook endpoint changes
- Importing keys and activating an API Signer


Any write action added to the platform in the future is frozen by default as
well.

Read access stays available. Users can still log in and view balances,
transaction history, and audit logs. A persistent banner across the web console
and mobile app shows that the workspace is frozen. Admins can also see when it
was frozen, by whom.

alt
A workspace
can be frozen even if it is disabled due to backup expiration. Uploading a
backup is not permitted while the workspace is frozen. 

## Who can freeze

Only an **Admin** can trigger or release a freeze. **Traders** and **Viewers**
can see the workspace state but cannot act on it. Every step of the freeze and
release flow is attributable and written to the
[audit log](/user-guide/export-audit-logs).

| Role / User type | Trigger freeze | Initiate release | Approve release quorum | View state |
|  --- | --- | --- | --- | --- |
| Admin | Yes | Yes (once CS enables) | Yes | Yes |
| Trader | No | No | No | Yes |
| Viewer | No | No | No | Yes |
| API User | Inherits from underlying user role | Inherits | Inherits | Yes |


## Freeze your workspace

You can freeze from either the web console or the mobile app. A confirmation
step prevents accidental triggers.

**From the web console:**

1. In the side menu, click **Settings** > **Emergency**.

2. In the **Emergency Freeze** area, click **Freeze Organization**.
3. Confirm the action by typing the confirmation keyword.


**From the mobile app:**

1. Open the emergency freeze control.
2. Confirm with your biometric or device passcode.


You can optionally record a free-text reason at freeze time, which is surfaced
in the audit log and notifications. The freeze takes effect immediately, and all
workspace users are notified in the app.

## Release a freeze

Releasing a freeze is intentionally harder than triggering one. The **Unfreeze
Organization** control stays disabled for everyone until
Fordefi Customer Success enables it.

1. **Contact your Fordefi CSM** through your shared Slack or Telegram channel to
request a release.
2. **Your CSM validates the request** — verifying the requester's identity and
confirming the incident is contained.
3. **Your CSM enables self-serve release.** The **Unfreeze Organization**
control in the web console and mobile app becomes active.
4. **An admin initiates the release.** In the **Emergency Freeze** area, the
admin clicks **Unfreeze Organization**. This does not unfreeze the workspace
immediately — it starts an [Admin Quorum](/user-guide/admin-quorum) approval, and
the workspace moves to **Pending unfreeze**.
5. **The Admin Quorum approves.** Once the quorum threshold is reached, the
workspace returns to active and the audit log records the full chain: the CSM
operator, the initiating admin, every approver, and all timestamps.