Compliance and control.Your sign-in, your roles, your audit trail.
What IT and compliance reviewers ask about: how people sign in, who may run which agent, which actions wait for a person, and what gets recorded.
- SAML 2.0 single sign-onYour identity providerConnected
- Domainarcadia.exampleVerified
- Enforce SSO for this domainOther ways to sign in stop workingOn
- Directory sync (SCIM 2.0)Members and groupsSyncing
People sign in through your identity provider. Enforce it, and no other way in works for your domain.
One account for the whole company. Owners and admins set it up in Account settings.
Four things IT asks for. Each one ships in the product.
Your identity providerPeople sign in the way they already do.
- SAML 2.0 single sign-on
- SCIM 2.0 directory sync
- Enforce SSO for your domain
Your roles and groupsWho opens which project, and runs which agent.
- Account and project roles
- Groups and custom roles
- All agents, or only the ones you pick
Rules you setAgents ask before the actions you choose.
- Allow, Ask or Block per action
- Project rules no agent can loosen
- One approval per exact call
A record you keepEvery action, exported or streamed.
- Refusals recorded too
- CSV or JSONL export
- A signed webhook to your tools
How it works.One topic at a time.
Single sign-on and directory sync
People sign in with SAML 2.0 single sign-on. Enforce it, and other ways to sign in for your domain stop working.
SCIM 2.0 keeps members and groups in sync. Map an identity provider group to a Kortix group once.
- Directory groupKortix group
arcadia-engEngineeringarcadia-supportSupportarcadia-finFinance
Ready for your security review.Run it where your policy says, and read every line.
Kortix Cloud
We run the platform and the cloud computers.
Self-hosted
The app, the API and the database on your server.
Your VPC or on-prem
A single-tenant deployment, scoped with us.
Open source
Read it, fork it, audit it.
SOC 2 Type I verified
GDPR operated. The security page has the full model.
Compliance, answered.From the code and the docs.
Anything else, write to the team.
Which identity providers work?
Sign-in uses SAML 2.0. Directory sync uses SCIM 2.0 and covers the request patterns Okta and Microsoft Entra ID use. Both need a team account, not the personal account Kortix creates at sign-up.
What happens when someone leaves the company?
Remove them in your identity provider. Directory sync removes them from Kortix, and they lose access to every project.
Does an agent act with the role of the person who runs it?
No. An agent acts as itself, with only the access its block in kortix.yaml grants. It cannot give itself a permission it does not hold.
Do agents ask for approval by default?
No. Approval rules are off until you set them. Mark an action Ask, or mark a whole connector sensitive, and those calls wait for a person.
How long is the audit log kept?
Events stay readable for 90 days. Events from 90 to 365 days old sit in a locked archive that nobody can shorten or delete, and you can export them.
Can admins open every session?
Only if an account owner turns on session oversight. It is off by default. Each change to it is recorded, and so is each session read that only oversight allowed.
What happens if our Enterprise contract ends?
Single sign-on and directory sync stay on for 14 days, so nobody is locked out.
Which certifications does Kortix hold?
SOC 2 Type I verified. GDPR is a posture we run, not a certificate.
Do these controls work on a self-hosted instance?
Yes. On a self-hosted instance, Enterprise turns them on for every account.