Most of the items security and identity teams put at the top of a questionnaire are already implemented and entitlement-gated to Enterprise. Below — what is shipping now, not roadmap.
SAML single sign-on plus full SCIM 2.0 user and group provisioning. Wired for Okta and Microsoft Entra ID; directory sync reconciles daily.
Build roles from a 50+ fine-grained permission registry and map them to your identity-provider groups. Every assignment recorded in an audit table.
Envelope encryption with your AWS KMS or GCP KMS key. Every decrypt logged with the user, action, and case it served — so a KMS access review is a single query.
HMAC-SHA-256 signed delivery, retry with backoff, secret rotation, and a test endpoint. Wire CaseAgent intake and retention events into your SIEM or SOAR.
Set a default retention at the workspace, then override on the cases legal needs longer. The retention sweeper respects per-case policy on every run.
Issue bearer tokens scoped to the workspace, with expiry and one-click revocation, for the integrations your platform team builds in-house.