Customer-Available Security Controls

Purpose

This document describes the security controls available to customers to help protect the security and confidentiality of their data when accessing the platform through the web application or API.

Authentication

Customers accessing the web application may authenticate using:

• Username and password
• Google Single Sign-On (SSO)
• Microsoft Single Sign-On (SSO)

These authentication options allow organizations to select an authentication method appropriate for their users and existing identity-management practices.

Multi-Factor Authentication (MFA)

Multi-factor authentication is available for web application users.

MFA may be:

• Enabled by an individual user for their own account; or
• Enforced organization-wide by an organization administrator, requiring users within the organization to use MFA.

Organization-wide MFA enforcement allows customer administrators to establish a consistent authentication requirement across their organization.

Role-Based Access Control

The platform provides role-based access control (RBAC) to allow customer organizations to control the level of access provided to individual users.

Customer-facing roles include:

Administrator

Customer administrators control access within their organization through administrative capabilities including:

• Managing organization users and their assigned roles
• Controlling the level of access provided to users through role assignment
• Enforcing MFA for users across the organization

These controls allow each customer organization to manage access according to its own security and operational requirements.

Team Member

Team Members may be assigned to specific entities within an organization.

Their access is limited to the entities to which they have been assigned and the beneficiaries associated with those entities. Team Members may perform permitted operations on those assigned entities and their associated beneficiaries.

This allows organizations to restrict operational access based on the entities for which an individual user is responsible.

Viewer

Viewers have read-only access. They may view information available to them but cannot modify the underlying data.

This role may be used when a user requires visibility into platform information without the ability to make changes.

API Authentication

Customers accessing the platform programmatically are provided an API key for authentication.

The API key acts as a credential for accessing the API and must be protected by the customer. Customers are responsible for storing API keys securely and preventing unauthorized disclosure or use.

API keys should not be embedded in publicly accessible source code or otherwise exposed to unauthorized parties.