Conformité et contrôle.Your sign-in, your roles, your audit trail.
Ce que les auditeurs IT et conformité demandent : comment les utilisateurs se connectent, qui peut exécuter quel agent, quelles actions attendent une personne et ce qui est enregistré.
- SAML 2.0 single sign-onYour identity providerConnected
- Domainarcadia.exampleVerified
- Enforce SSO for this domainOther ways to sign in stop workingOn
- Directory sync (SCIM 2.0)Members and groupsSyncing
People sign in through your identity provider. Enforce it, and no other way in works for your domain.
Un seul compte pour toute l'entreprise. Owners and admins set it up in Account settings.
Quatre exigences de l'IT. Each one ships in the product.
Your identity providerPeople sign in the way they already do.
- SAML 2.0 single sign-on
- SCIM 2.0 directory sync
- Enforce SSO for your domain
Your roles and groupsQui ouvre quel projet et exécute quel agent.
- Account and project roles
- Groups and custom roles
- All agents, or only the ones you pick
Rules you setAgents ask before the actions you choose.
- Allow, Ask or Block per action
- Project rules no agent can loosen
- One approval per exact call
A record you keepEvery action, exported or streamed.
- Refusals recorded too
- CSV or JSONL export
- A signed webhook to your tools
Fonctionnement.One topic at a time.
Authentification unique et synchronisation des annuaires
People sign in with SAML 2.0 single sign-on. Enforce it, and other ways to sign in for your domain stop working.
SCIM 2.0 keeps members and groups in sync. Map an identity provider group to a Kortix group once.
- Groupe d'annuaireGroupe Kortix
arcadia-engEngineeringarcadia-supportSupportarcadia-finFinance
Prêt pour votre revue de sécurité.Run it where your policy says, and read every line.
Kortix Cloud
We run the platform and the cloud computers.
Auto-hébergé
The app, the API and the database on your server.
Your VPC or on-prem
A single-tenant deployment, scoped with us.
Open source
Read it, fork it, audit it.
SOC 2 Type I verified
GDPR operated. The security page has the full model.
Conformité, sans détour.From the code and the docs.
Anything else, write to the team.
Which identity providers work?
Sign-in uses SAML 2.0. Directory sync uses SCIM 2.0 and covers the request patterns Okta and Microsoft Entra ID use. Both need a team account, not the personal account Kortix creates at sign-up.
What happens when someone leaves the company?
Remove them in your identity provider. Directory sync removes them from Kortix, and they lose access to every project.
Does an agent act with the role of the person who runs it?
No. An agent acts as itself, with only the access its block in kortix.yaml grants. It cannot give itself a permission it does not hold.
Do agents ask for approval by default?
No. Approval rules are off until you set them. Mark an action Ask, or mark a whole connector sensitive, and those calls wait for a person.
How long is the audit log kept?
Events stay readable for 90 days. Events from 90 to 365 days old sit in a locked archive that nobody can shorten or delete, and you can export them.
Can admins open every session?
Only if an account owner turns on session oversight. It is off by default. Each change to it is recorded, and so is each session read that only oversight allowed.
What happens if our Enterprise contract ends?
Single sign-on and directory sync stay on for 14 days, so nobody is locked out.
Which certifications does Kortix hold?
SOC 2 Type I verified. GDPR is a posture we run, not a certificate.
Do these controls work on a self-hosted instance?
Yes. On a self-hosted instance, Enterprise turns them on for every account.