Log in Get Started

Built for teams that take identity seriously

An overview of how sign-in, provisioning, and account activity work under the hood.

SSO

SAML 2.0 or OpenID Connect, both SP- and IdP-initiated.

SCIM

Automatic user and group provisioning from your identity provider.

Two-factor auth

TOTP-based MFA with one-way-hashed, single-use recovery codes.

Audit logs

Searchable log of sign-ins, role changes, and config changes.

API tokens

Bearer tokens scoped to your account, shown once, revocable anytime.

Single sign-on (SSO)

Organizations on Business plans and above can connect either SAML 2.0 or OpenID Connect. SAML assertions are signature-verified against your identity provider's X.509 certificate, with unsolicited-response replay protection enabled. OpenID Connect uses the full authorization-code flow with PKCE, state, and nonce checks, and ID tokens are verified against your provider's live JWKS. Both SP-initiated (starting from our login page) and IdP-initiated (starting from your identity provider's app tile) flows are supported. Team members can also be routed to your organization's SSO automatically just by entering their work email address, once you've verified your company's domain.

SCIM provisioning

Enterprise organizations can let their identity provider automatically create, update, and deactivate user accounts via SCIM 2.0, authenticated with an org-scoped bearer token. Group provisioning is also supported - synced groups can be mapped to automatically grant the Admin role to their members, staying in sync as group membership changes upstream.

Two-factor authentication

Both creator and administrator accounts can enable TOTP-based two-factor authentication using any standard authenticator app. One-time recovery codes are generated at setup and stored as one-way hashes, consumed on use, so they can't be replayed even if the stored record were somehow exposed.

Audit logs

Organization owners on Business plans and above get a searchable log of security-relevant events - sign-ins, role changes, SSO/SCIM configuration changes, invite activity, API token and webhook changes - each entry recording the actor, IP address, and timestamp.

API tokens & webhooks

API access uses bearer tokens scoped to your account, shown once at creation and revocable at any time. Outbound webhooks are signed with your webhook secret using HMAC-SHA256 on every delivery, so you can verify a payload genuinely came from us before trusting it.

This page describes our security architecture and is not a compliance certification. We don't currently hold formal certifications such as SOC 2 or ISO 27001. If your organization requires a specific certification, contact us before you rely on this page for a compliance decision.

Questions about rolling this out for your team?

Talk to us about SSO, SCIM, or Enterprise plans.

Contact Sales