SAML 2.0 or OpenID Connect, both SP- and IdP-initiated.
Automatic user and group provisioning from your identity provider.
TOTP-based MFA with one-way-hashed, single-use recovery codes.
Searchable log of sign-ins, role changes, and config changes.
Bearer tokens scoped to your account, shown once, revocable anytime.
Organizations on Business plans and above can connect either SAML 2.0 or OpenID Connect. SAML assertions are signature-verified against your identity provider's X.509 certificate, with unsolicited-response replay protection enabled. OpenID Connect uses the full authorization-code flow with PKCE, state, and nonce checks, and ID tokens are verified against your provider's live JWKS. Both SP-initiated (starting from our login page) and IdP-initiated (starting from your identity provider's app tile) flows are supported. Team members can also be routed to your organization's SSO automatically just by entering their work email address, once you've verified your company's domain.
Enterprise organizations can let their identity provider automatically create, update, and deactivate user accounts via SCIM 2.0, authenticated with an org-scoped bearer token. Group provisioning is also supported - synced groups can be mapped to automatically grant the Admin role to their members, staying in sync as group membership changes upstream.
Both creator and administrator accounts can enable TOTP-based two-factor authentication using any standard authenticator app. One-time recovery codes are generated at setup and stored as one-way hashes, consumed on use, so they can't be replayed even if the stored record were somehow exposed.
Organization owners on Business plans and above get a searchable log of security-relevant events - sign-ins, role changes, SSO/SCIM configuration changes, invite activity, API token and webhook changes - each entry recording the actor, IP address, and timestamp.
API access uses bearer tokens scoped to your account, shown once at creation and revocable at any time. Outbound webhooks are signed with your webhook secret using HMAC-SHA256 on every delivery, so you can verify a payload genuinely came from us before trusting it.
This page describes our security architecture and is not a compliance certification. We don't currently hold formal certifications such as SOC 2 or ISO 27001. If your organization requires a specific certification, contact us before you rely on this page for a compliance decision.
Talk to us about SSO, SCIM, or Enterprise plans.
Contact Sales