Security documentation
A plain summary here. The detail is shared with your security team on request.
Sign in through your identity provider (OIDC or SAML), or with an emailed code. Passkeys and authenticator codes protect sensitive actions. Preview
Roles built from permissions, conflicts flagged, access approved by a named person, and able to end on its own.
Each customer’s data is separated in the database itself, and checked by automated tests.
An audit log where each entry is chained to the one before. Export it or stream it to your tools. Preview
If we need to look at your data, you approve it, for a set time, read-only by default. Preview
An agent gets less than the person it acts for, for a limited time, and is revocable at once. Preview
What we defend against on sign-in and access, and what is left.
Our own checklist review. It is not independent verification.
The full statement of controls and hosting.
Prepared answers to the usual 40-odd security questions.
