Security

Security

Configure authentication, encryption, and compliance settings.

---

Single Sign-On (SSO)

Supported Providers

Provider	Protocol
Okta	SAML 2.0, OIDC
Azure AD	SAML 2.0, OIDC
Google Workspace	SAML 2.0, OIDC
OneLogin	SAML 2.0
Ping Identity	SAML 2.0, OIDC
Custom	SAML 2.0, OIDC

SAML Configuration

1. Go to Administration → Security → SSO
2. Select SAML 2.0
3. Configure:
   • Identity Provider metadata URL
   • Entity ID
   • Assertion Consumer Service URL
   • Certificate
4. Test the connection
5. Enable SSO

OIDC Configuration

1. Go to Administration → Security → SSO
2. Select OpenID Connect
3. Configure:
   • Client ID
   • Client Secret
   • Authorization endpoint
   • Token endpoint
   • Scopes
4. Test the connection
5. Enable SSO

---

Encryption

Data at Rest

All stored data is encrypted:

Data Type	Encryption
Conversation logs	AES-256
User data	AES-256
API keys	AES-256 with key rotation
Knowledge indexes	AES-256

Data in Transit

All network communication uses:

• TLS 1.3 (preferred)
• TLS 1.2 (minimum)
• Certificate pinning for mobile apps

Key Management

• Keys stored in secure key management service
• Automatic key rotation (configurable)
• Customer-managed keys available (Enterprise)

---

Service Accounts

Overview

Service accounts enable programmatic access without user credentials.

Create Service Account

1. Go to Administration → Security → Service Accounts
2. Click Create Service Account
3. Configure:
   • Name and description
   • Permission scopes
   • IP allowlist (optional)
4. Generate credentials
5. Securely store credentials

Permission Scopes

Scope	Access
read:agents	View agent configurations
write:agents	Create and modify agents
read:conversations	Access conversation logs
read:analytics	View analytics data
admin:users	Manage users

---

Access Control

Role-Based Access

Role	Permissions
Platform Admin	Full platform access
Workspace Admin	Manage workspace settings and users
Agent Developer	Create and modify agents
Analyst	View analytics and reports
User	Interact with deployed agents

Custom Roles

Create custom roles for specific needs:

1. Go to Security → Roles
2. Click Create Role
3. Select permissions
4. Assign to users or groups

---

Compliance

Data Residency

Configure where data is stored:

Region	Data Centers
US	US East, US West
EU	Ireland, Frankfurt
APAC	Singapore, Sydney

Certifications

Certification	Status
SOC 2 Type II	Certified
ISO 27001	Certified
GDPR	Compliant
HIPAA	Available (Enterprise)

Data Retention

Configure retention policies:

Retention Policy:
  conversations:
    default: 90 days
    extended: 365 days
  analytics:
    default: 365 days
  audit_logs:
    default: 365 days
    compliance: 7 years

---

Audit Logging

Logged Events

Category	Events
Authentication	Login, logout, SSO events
Authorization	Permission changes, role assignments
Data access	Conversation access, exports
Configuration	Agent changes, settings updates
Security	API key creation, service accounts

Log Export

Export logs for SIEM integration:

• Real-time streaming (Splunk, Datadog)
• Scheduled exports (S3, Azure Blob)
• On-demand download (CSV, JSON)

---

Network Security

IP Allowlisting

Restrict access by IP:

1. Go to Security → Network
2. Enable IP allowlisting
3. Add allowed IP ranges
4. Configure enforcement (warn or block)

Private Connectivity

Enterprise options:

Option	Description
VPN	Site-to-site VPN connection
Private Link	AWS PrivateLink, Azure Private Link
Dedicated	Dedicated infrastructure

---

Related

• Administration
• Analytics
• Getting Started