This page states what the platform actually does. Where a control is still in progress or has a real limit, we say so rather than rounding up.
The two are kept deliberately separate. Your identity provider says who someone is; the platform decides — every time — what that person may do inside your organization.
OIDC tokens are verified against an injected HTTPS issuer, audience, an asymmetric algorithm allowlist, JWKS, expiry, issued-at maximum age, and clock tolerance.
Verified external tenant and group claims can satisfy a narrowly configured identity binding, but the resulting actor receives roles only from an active organization membership you own.
OAuth state is bound to a short-lived HttpOnly PKCE cookie, redirects derive only from the identity catalog, logout requires an exact same-origin POST, and session cookies stay host-only with a bounded lifetime.
Durable workflow requests and approval checkpoints never serialize permission, role, assurance, session, or token claims — only a tenant-bound actor reference that is re-authorized on resume.
Protected execution payloads are encrypted with tenant-selected keys resolved through the secret boundary. Tenant, execution, reference, and purpose identifiers are authenticated with the ciphertext.
PostgreSQL is reachable only on the private network, and database passwords are file-mounted secrets rather than environment values or connection URLs.
Schema changes are checksum-locked so a migration cannot silently diverge between environments.
Idempotency records and protected payloads expire on configured schedules, coordinated so a record never promises a replay whose payload has already expired.
Audit events are append-only and contain identifiers, policy decisions, timing, and redacted summaries. Execution failures are recorded as coarse categories rather than exception messages or vendor response bodies. Idempotency records hold request fingerprints and opaque payload references, never raw request or result data.
Successful reads of the audit stream are themselves authorized and audited, evidenced with only the actor, page size, result count, and cursor presence.
On dependency scanning: the platform's dependency audit command transmits dependency and advisory metadata to a public advisory service. That narrow command does not authorize transmitting source code, secrets, credentials, customer information, business data, or arbitrary repository contents. Any other external scanner carries its own approval and data-boundary requirement.
If your team needs to review controls before a pilot, call us and we'll go through them directly — including the areas that are still in progress. Detailed architecture and security documentation is available under NDA.
