Security & Infrastructure
Built for regulated
environments.
Government and corporate accessibility programs require platforms that handle sensitive audit data with the same rigor they apply to compliance itself. Here is how the platform is built.
Authentication
Enterprise identity. No passwords.
Authentication is handled exclusively by trusted enterprise identity providers. There are no platform-managed passwords and no credential database to breach. Users sign in with their existing organizational identity — then access is governed by role assignment within the platform.
Microsoft Entra ID
Multi-tenant OAuth 2.0. Any Microsoft organizational account. Azure MSAL integration with OpenID Connect.
Google OAuth 2.0
Google Workspace and personal Google accounts. Standard OAuth 2.0 authorization code flow with PKCE.
No platform passwords
User credentials live in your identity provider, not the platform. There is no password reset flow, no credential storage, and no authentication database to protect.
Role-based access
Admin, Operator, and ReadOnly roles control what each user can do. Roles are assigned per-organization, not globally — a user can be an Operator in one org and ReadOnly in another.
Device JWT support
Device-local JWT authentication is available for programmatic access and automated tooling without requiring interactive OAuth flows.
Data Protection
Credentials encrypted. Data isolated.
Integration credentials, API keys, and sensitive configuration are never stored in plaintext. Each organization's secrets are isolated and encrypted independently using Azure Data Protection APIs with Key Vault key management.
Azure Key Vault
Encryption keys managed in Azure Key Vault. Key rotation, access policy enforcement, and audit logging handled at the infrastructure level.
Per-organization isolation
Each organization's secrets are encrypted with independent keys. One organization cannot access another's credentials, projects, or findings.
Data Protection API
ASP.NET Core Data Protection used for person-level and organization-level secret encryption. Keys persisted with Azure Blob Storage and Key Vault backing.
Screenshot access control
Screenshots stored in Azure Blob Storage with access-controlled share links. Shared links are scoped and time-limited — direct access to storage is not exposed.
Infrastructure
Azure-native. Enterprise-grade.
The platform runs on Microsoft Azure infrastructure — the same cloud used by enterprise and government organizations globally for their most sensitive workloads.
Database
Azure SQL
Retry policies, connection pooling, and managed identity authentication. 180-second command timeout for long-running scan operations.
Storage
Azure Blob Storage
Screenshot storage with lossless WebP encoding, content encoding support, and streaming downloads. No public container access.
Transport
HTTPS everywhere
All API and UI traffic encrypted in transit. CORS policy configured to allow only known origins. No mixed content.
Rate limiting
Bounded channels
Crawl and scan operations managed through bounded task queues with semaphore-controlled concurrency. Protection against resource exhaustion.
Questions?
Security requirements? Let's talk.
For procurement or compliance review, contact us directly with your specific security questionnaire or requirements.