Company · Trust Center

Security, as shipped

This page lists what's actually built, not a certifications wall. Formal certifications (SOC 2, ISO 27001) are not in place yet.

In place today

WebAuthn passkeys and a real SAML 2.0 identity-provider mode with signature validation
Org-scoped rate limiting, CORS policy, and admin authentication
Redis-backed session and challenge state
Role-based access control checked server-side on every request, not left to the client
Every SAML service provider and access-control policy is scoped to a single organization