Security

Sensitive by nature

Authoryn sits next to privileged systems. In pilot setups, connector secrets and governance data usually stay in the customer's environment.

Draft page. Subprocessors, DPAs, and certification timelines come before enterprise procurement. No SOC 2 badge until there is a real program behind it.

Deployment

Default for enterprise is single-tenant software in your cloud or VPC. We can also run a dedicated stack per customer. Shared multi-tenant hosting is not the day-one model.

Connector secrets

GitHub PATs, AWS keys, and Entra client secrets are the crown jewels. Storage is pluggable: customer Key Vault, HashiCorp Vault, or inject at deploy time depending on packaging.

Evidence

Governance and JIT events append to a log the UI and API both read. Useful for incidents and audits; same shape whether you query in-app or export.

JIT guardrails

No duplicate pending requests. Active JIT blocks a second request for the same target. Service accounts cannot request elevation. Approver must differ from requester. Duration capped at your max.

Procurement questions

On a pilot call we can walk through architecture, data flows, and connector permissions. Ask for a security questionnaire when you are ready for that step.