Enterprise security, built into every Autessa company

Yes. Autessa single sign-on works with Google Workspace or Microsoft Entra ID as your identity provider. You verify each email domain with a DNS record, choose the role new members get, and turn on Require SSO so everyone with that email address signs in through your provider.

Yes. Every Autessa company starts with encryption, private-by-default resources, built-in roles, run identity and execution history in place. From there you shape it to how your company works: SSO and the role new members get, custom roles, sharing, row rules and column masks, session lengths, secrets and API key scopes.

Yes. Each member can turn on two-step verification with an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password, or with codes sent by email, and gets single-use recovery codes. To require MFA for everyone, turn on Require SSO and enforce MFA at your identity provider.

Roles decide which areas of Autessa a member can use, and sharing decides what they can do with each resource. Built-in roles (Admin, Developer, Manager, Accountant, User) cover common jobs, and custom roles hold exactly the permissions you choose. Every resource starts private and is shared at Viewer, Editor, Publisher or Admin, and a person gets the highest level of any grant that covers them.

Yes. AutessaDB roles filter which rows a person, team, company role, app visitor or API key sees, using placeholders like $CURRENT_USER_ID, and column rules show a column in full, masked (redacted, last four or a hash) or hidden. A table can be set closed by default, so anyone without a matching role sees no rows.

Autessa Secrets encrypts each value and never returns it from any screen, API, log or export. Tools use a secret through a handle that is filled in only inside an HTTPS request to the secret’s allowed hosts. Sealed secrets can never be viewed; Revealable ones can be viewed once after a different manager approves.

Yes. When access logging is on for your company, the data access log records every read, decrypt, create, update and delete of protected table data, naming the person it was for and the key, tool, agent or app it went through, with the IP and request path. Entries sit on a hash chain that Autessa verifies when you read them.

Each Autessa company is its own isolation boundary for people, resources, data and encryption keys. Every request is scoped to one company before it touches data, credentials only reach their own company, and sensitive data is encrypted at rest with AES-256 using keys unique to your company.

Yes. Turn on PII and PHI stripping and Autessa replaces email addresses, phone numbers, Social Security numbers, card numbers, IP addresses, IBANs, dates of birth and your own custom types with placeholders before a prompt reaches any model, then puts the real values back in the answer.

No. Scripts, tools, agents, apps, scheduled jobs and API keys can use a secret but can never read or reveal it. A Sealed secret cannot be viewed by anyone, including the owner, an admin or support. Company admins do not get access to secrets automatically.

Autessa’s security documentation, policies and compliance reports are on the Trust Center at trust.autessa.com, the place for reports and security questionnaires.