Set up your Haven organization
Short answer
Sign in at account.starthaven.com, add your people, push the extension, choose what Haven protects, then switch from Monitor only to Active enforce once you have watched a normal week. That order avoids blocking something your team needs.
Before you start
Haven sets up your organization, owner account and email domain before your first sign in.
Do the steps in this order: people first, then what Haven protects, then enforcement.
1. Find your console
Sign in at account.starthaven.com with the address your Haven contact set up. The left menu starts with Overview, then People, Protection and Reports, and ends with Billing. If you belong to more than one organization, check that the switcher at the top names the right one. If there is no Overview, see the fix entry on that.
2. Add your team
People join a Haven organization by invite, by automatic joining for people on a verified domain, or by asking to join and being approved by an admin.
To invite someone, open Members & seats, choose Add member, enter their work email and pick a role. Most people should be members; give admin only to the people who will manage policy. In a Haven Business organization every member uses a seat, owners and admins included, and an invitation that hasn't been accepted yet holds a seat until it is accepted or revoked.
3. Install Haven everywhere
People can install Haven themselves from the Chrome Web Store, which is fine for a small team. For anything larger, push it centrally (see the Google Workspace guides). Installing or pushing the Haven extension does not add anyone to your Haven organization; that happens through Haven's invite or sign in flow.
4. Choose what Haven protects
Under Protection you'll find Policy, Protected sites and Extensions.
- Protected sites. Add categories and sites; a category makes every site in it Protected, and you can untick single sites inside it. Banking and payroll are the usual starting points.
- Required. Every category and site an organization picks for Protected sites is Required by that organization: always Protected for every member it reaches, and members can't turn it off.
- Extension allow list. Password managers are allowed to keep running on Protected sites by default. Once an organization adds its first allowed extension, its own allow list takes over: every extension not on it, password managers included, is paused on Protected sites.
In a Haven organization, what the organization or a group requires is Protected for every member it reaches, whatever the member would choose: members can't turn it off. A member's Protected sites are everything the organization and each of their groups require, added together. Where organization and group settings disagree on enforcement or a setting, Haven applies the more protective, and someone in several groups gets the most senior role and the most protective policy of any of them.
5. Turn on enforcement
New Haven organizations start in Monitor-only: Haven records what it would have done and changes nothing for anyone, while Overview and the Risk Report fill up as they would under enforcement. An owner or admin switches to Active Enforce when ready.
When you are ready, go to Policy, then Enforcement, then Active enforce. Your own browser applies a change to enforcement straight away. Other members' browsers pick it up within about five minutes, because each one checks for policy changes on a timer.
Groups and Google Workspace (optional)
A Haven group can carry its own enforcement mode, its own Protected categories and sites, an extension allow list and settings, so one organization can hold different teams to different policies. A group's categories and sites reach its members as Required, on top of the organization's.
Connecting Google Workspace lets Haven map existing Workspace groups onto Haven groups so membership keeps itself up to date, and you can disconnect from the same page.
Two smaller things
- Email aliases. Adding a teammate's second email address to their member record lets Haven recognize mail from it as a colleague instead of flagging it as someone impersonating your team. The teammate confirms the address by email, and it is not a way to sign in.
- Gmail link scanning is one of the things to ask Haven for, listed at the top.
Odd numbers on the member list
The extension count on the member list is what that person's browser last reported; opening their row shows the actual list. "Not reported yet" means their browser has not sent a list in.
How Haven handles this
- Haven sets up your organization, owner account and email domain before your first sign in. Adding or verifying another domain, turning on automatic joining, turning on Gmail link scanning and changing seat count are things to ask Haven for.Verified by engineering October 29, 2026
- People join a Haven organization by invite, by automatic joining for people on a verified domain, or by asking to join and being approved by an admin. Automatic joining is off unless you ask Haven to turn it on. When it is off, a domain match becomes a request to join.Verified by engineering October 29, 2026
- In a Haven Business organization every member uses a seat, owners and admins included, and an invitation that hasn't been accepted yet holds a seat until it is accepted or revoked. Removing someone frees their seat for the next person but does not lower your seat count.Verified by engineering October 28, 2026
- Installing or pushing the Haven extension does not add anyone to your Haven organization; that happens through Haven's invite or sign in flow.Verified by engineering October 28, 2026
- Every category and site an organization picks for Protected sites is Required by that organization: always Protected for every member it reaches, and members can't turn it off. There is no separate lock or Required switch. To stop requiring something, an admin removes the row, or unticks single sites inside a category, on the Protected sites page.Verified by engineering October 29, 2026
- Password managers are allowed to keep running on Protected sites by default. Once an organization adds its first allowed extension, its own allow list takes over: every extension not on it, password managers included, is paused on Protected sites. Applies to Haven Business organizations.Verified by engineering October 29, 2026
- In a Haven organization, what the organization or a group requires is Protected for every member it reaches, whatever the member would choose: members can't turn it off. A member's Protected sites are everything the organization and each of their groups require, added together. Where organization and group settings disagree on enforcement or a setting, Haven applies the more protective, and someone in several groups gets the most senior role and the most protective policy of any of them. Allowed extensions work the other way: a group's list adds to the organization's allow list for that group.Verified by engineering October 29, 2026
- New Haven organizations start in Monitor-only: Haven records what it would have done and changes nothing for anyone, while Overview and the Risk Report fill up as they would under enforcement. An owner or admin switches to Active Enforce when ready. The Help Center suggests a normal working week in Monitor-only before switching to Active Enforce.Verified by engineering October 28, 2026
- Your own browser applies a change to enforcement straight away. Other members' browsers pick it up within about five minutes, because each one checks for policy changes on a timer.Verified by engineering October 28, 2026
- A Haven group can carry its own enforcement mode, its own Protected categories and sites, an extension allow list and settings, so one organization can hold different teams to different policies. A group's categories and sites reach its members as Required, on top of the organization's. A group's rules can make it stricter than the organization, not looser: a group set to Monitor-only does not relax an organization that is enforcing.Verified by engineering October 29, 2026
- Connecting Google Workspace lets Haven map existing Workspace groups onto Haven groups so membership keeps itself up to date, and you can disconnect from the same page.Verified by engineering October 28, 2026
- Adding a teammate's second email address to their member record lets Haven recognize mail from it as a colleague instead of flagging it as someone impersonating your team. The teammate confirms the address by email, and it is not a way to sign in.Verified by engineering October 28, 2026
- The extension count on the member list is what that person's browser last reported; opening their row shows the actual list. "Not reported yet" means their browser has not sent a list in.Verified by engineering October 28, 2026