Security

Identity and access management

• Attest supports organization-specific sign-in and enterprise SSO using SAML or OIDC-compatible identity providers.
• Administrative and participant experiences are separated by authorization policies and assigned roles.
• Authentication and session cookies are protected with secure, HTTP-only settings in production.
• Organizations remain responsible for user lifecycle, identity-provider configuration, role assignment, and prompt removal of access that is no longer required.

Application and data protection

• Public traffic is protected with HTTPS. Internal application dependencies are isolated from public ingress.
• Service credentials and sensitive configuration are supplied through protected runtime configuration rather than embedded in client-facing code.
• Input validation, anti-forgery protection, access checks, and client-safe error handling are applied to sensitive workflows.
• Durable Attest records use the managed platform data path rather than direct browser or application access to database systems.

Evidence integrity and auditability

Attest is built to preserve the context needed to evaluate an acknowledgement or governance action later. Evidence records can include the actor, organization, event time, policy or document version, campaign context, and integrity metadata. Administrative actions are logged so authorized reviewers can trace material activity.

Evidence should be evaluated together with the organization’s identity, retention, policy-approval, and access-governance processes. Attest strengthens the record; it does not replace those controls.

Infrastructure and operations

Attest runs as a containerized service on managed Kubernetes infrastructure. Runtime health checks, multiple application replicas, controlled image deployment, persistent application key protection, centralized logs, and immutable release tags support reliable and reviewable operations.

Security changes are built and tested before deployment, published as immutable images, rolled out through the application deployment, and verified against public and direct-origin health routes.

Customer security responsibilities

• Use enterprise SSO where appropriate and enforce strong authentication in the identity provider.
• Limit administrator roles and review access regularly.
• Configure assessment privacy and campaign visibility to match organizational requirements.
• Avoid placing secrets, credentials, or unnecessary sensitive information in free-text fields.
• Export and retain evidence according to the organization’s legal, audit, and records-management obligations.