SecurityUpdated 2026-05-13
How is access controlled?
Role-based access, row-level security on every tenant table, audit trail on every privileged action. Optional SSO with SAML 2.0.
Roles: learner, manager, branch admin, org admin, super admin, auditor (read only).
Row-level security: enforced at the database tier. A manager cannot read another branch even if the application tier has a bug.
Audit trail: every privileged action (seat assignment, certificate revocation, data export, role change) is logged with actor, target, timestamp, and IP.
SSO: SAML 2.0 supported. SCIM provisioning available on the 1000+ seat plan.
MFA: required for all admin roles. TOTP supported, hardware keys (FIDO2) on request.