Authentication

Authentication controls that exist in the product today:

• Email and password with salted one-way password hashing; sessions are signed tokens delivered in HttpOnly, Secure cookies, revoked on logout and invalidated on password change or reset.
• Google sign-in with server-side verification of the signed identity token (signature, issuer, audience, verified email).
• Sign in with Apple verified against Apple's public keys.
• Enterprise single sign-on through Microsoft Entra ID, generic OIDC, or SAML, configured per deployment and validated against the live identity provider during onboarding.
• Organization roles enforced server-side (member, billing admin, team admin, security admin, auditor, owner), with platform staff routes gated separately.
• SCIM user provisioning and deprovisioning with token-based deployment credentials; deactivating a member revokes their sessions.

Self-service accounts do not currently have built-in multi-factor authentication; enterprise customers can require MFA or step-up through their own identity provider. A security key or authenticator option for individual accounts is not available today.