Security controls & verification scope
Technical controls documented in the source, and the boundary between source-available capability and unverified deployment or contract facts.
What source evidence supports
This page separates controls present in the source from facts that need deployment, operational, or contract evidence. It is not a deployment attestation or legal assessment.
| ITEM | DETAIL | STATUS |
|---|---|---|
| Privacy and data-location position | Deployment and contract facts about data handling and location are not verified here. Requires deployment, operational, or contract evidence before it can be stated as a public fact. | Deployment / contract not verified |
| SAML SSO capability | Source-documented SAML SSO capability; deployment, plan entitlement, and identity-provider configuration are not verified here. Source evidence only; deployment, entitlement, retention, and enforcement are not verified. | Source available |
| Tenant audit-event capability | Source-documented tenant audit events; no universal retention period is asserted. Source evidence only; deployment, entitlement, retention, and enforcement are not verified. | Source available |
| MFA capability | Source-documented TOTP MFA and recovery codes; no organisation-wide enforcement is asserted. Source evidence only; deployment, entitlement, retention, and enforcement are not verified. | Source available |
Read known limitations — Each entry below is source-evidenced. Source evidence cannot prove a live configuration, delivery outcome, entitlement, contract, or independent review.
Technical capabilities in the source
Transport and secret protection
The source contains transport and secret-protection mechanisms, including TLS and encrypted secret handling. This describes capability, not a deployed configuration or assurance.
Identity and access paths
The source contains MFA, SAML, roles, scoped API tokens, and session-revocation paths. Availability, tenant configuration, and enforcement require deployment evidence.
Found a vulnerability? Here’s the playbook.
Email [email protected]. Please include enough detail for the team to reproduce and assess the report.
Send a detailed report to the security email address below
Include reproduction steps and the potential impact
The team reviews the report and assesses severity
Follow-up and remediation timing depend on the report and operational context
Please do not publish details before coordinated handling is agreed