✓Multi-tenant isolation
Every query is scoped to your company. An automated isolation suite proves no route can reach another tenant's data.
✓Encryption
Third-party credentials are encrypted at rest in a per-tenant vault (Fernet); all traffic is served over TLS.
✓Immutable audit trail
Every sensitive action is written to a hash-chained, tamper-evident log — exportable as SOC 2 evidence.
✓Enterprise SSO (OIDC)
Bring your own identity provider. Users sign in against your directory; identity is verified from a signed token.
✓SCIM 2.0 provisioning
Automated user provisioning and deprovisioning. Deactivating a user in your IdP ends their sessions immediately.
✓Multi-factor auth (TOTP)
Optional time-based one-time-password MFA for an added layer beyond the password.
✓Granular RBAC
Custom roles with least-privilege access. The account owner can never be locked out of their own workspace.
✓Data governance
Export your data to CSV / BI at any time, plus retention and erasure controls for data-subject requests.