Authentication & SSO
Compliance OS uses authenticated identities and signed client context to help ensure that a user operates within the correct organization and authorized applications.Identity
Users authenticate through an approved sign-in method configured for the environment. Depending on the client and deployment, this may include password-based or federated identity options. Authentication establishes who the user is. It does not by itself grant access to every Compliance OS client, engagement, or application.Client context
After sign-in, the platform verifies the client context associated with the portal being accessed. This helps bind the session to the organization the user is actually trying to enter.Application authorization
Child applications such as the Interview Application, Remediation Workspace, and Security Program Hub perform their own authorization checks. The Client Portal therefore does not act as a universal authorization bypass.Session protection
Compliance OS uses signed session information to carry trusted client context between coordinated applications. Verification applications validate the session rather than trusting client-supplied identifiers. At a high level, the model is intended to bind the session to:- the authenticated user,
- the client,
- the client portal context,
- authorized data context.
Security expectations for users
Users should:- protect their sign-in credentials,
- use approved devices and networks where required,
- avoid sharing accounts,
- sign out from shared devices,
- report suspicious login behavior,
- never send access tokens or one-time codes through support messages.