Content Portal · Security & Access

Who Sees What, and How We Know

Single sign-on against your identity provider, authorization enforced on the server rather than hidden in the interface, application hardening, and an audit trail that answers who saw which revision and when.

Identity and session handling
SAML single sign-on against your existing identity provider, so portal access follows joiners and leavers automatically rather than through a separate user list somebody has to remember to prune.
- SAML SSO integration
- Short-lived access tokens with silent refresh, rather than long-lived sessions
- Session fingerprinting to detect hijacked sessions
- A cap on concurrent sessions per user
Authorization
Permissions are enforced on the server for every request, and mirrored in the interface so users are not shown controls they cannot use. Scoping runs through organization, department, and role.
- Role-based access control enforced server-side, not just hidden in the UI
- Organization and department scoping on content and users
- Access request workflow for users who need something they cannot currently see
Application hardening
The application implements the controls you would expect a security review to ask about, applied as defense in depth rather than at a single boundary.
- Rate limiting on authentication endpoints against brute force
- CSRF protection on state-changing requests
- Content-Security-Policy, HSTS, X-Frame-Options, and X-Content-Type-Options headers
- Input sanitization against injection, cross-site scripting, and path traversal
Audit and traceability
Activity is logged, and content access is recorded through the same events pipeline that drives usage analytics — so the question 'who saw this revision, and when' has an answer.
- Activity logging across the application
- Request logging
- Per-view and per-download event capture
- Retained version history, so the state of a document at a point in time is recoverable