PUBLIC WEBSITE

Enterprise Identity & Access

Identity & Access

ReguShield's identity and access model and how each capability is made available. Role-based access control and the invite and membership flow are available to every organization. Available with limits: Multi-factor authentication (authenticator app), Step-up verification for sensitive actions, Session listing and sign-out, Identity security audit log. Available through controlled enterprise activation — set up for your organization during onboarding: Require MFA for your organization, Single sign-on — OpenID Connect, SSO discovery and enforcement, Verified domains, SCIM 2.0 user and group provisioning, Just-in-time provisioning. OpenID Connect single sign-on is configured per organization, and each connection is activated only after a successful test sign-in. Planned: Single sign-on — SAML 2.0. Authentication and tenant isolation (Supabase Auth + row-level security) remain the security boundary.

Available

Available with limits

Controlled activation

Early Access

Planned

Not currently available

Posture

Identity & Access Capabilities

SSO, SAML, OIDC, SCIM, MFA, session, network, device and RBAC — each with how it is made available.

Authentication · OAuth2 / JWT

Available

Supabase Auth (email/password) with JWT sessions verified server-side on every request.

Single Sign-On (SSO) · SSO

Controlled activation

Per-organization SSO with email-domain discovery and optional enforcement, lockout-protected. Available once an OpenID Connect connection is active for your organization.

SAML 2.0 · SAML 2.0

Planned

SAML 2.0 federation with your identity provider. Planned; not offered today.

OpenID Connect (OIDC) · OIDC

Controlled activation

Per-organization OIDC (authorization code + PKCE) with issuer discovery and signed-token verification. Set up during enterprise onboarding; activated only after a successful test sign-in.

SCIM Provisioning · SCIM 2.0

Controlled activation

SCIM 2.0 Users and Groups with reveal-once bearer tokens and IdP-group role mappings (never owner). Enabled per organization during enterprise onboarding.

Multi-Factor Authentication · TOTP

Available with limits

Authenticator-app (TOTP) enrolment, sign-in challenge and step-up for sensitive actions. Passkeys are not supported.

Identity Policies · Policy

Controlled activation

Per-organization MFA requirement, SSO enforcement, step-up window and absolute session age, set by the organization owner.

Session Controls · Session

Available

Sessions verified server-side on every request; see and sign out your active sessions. No concurrent-session limit or server-side idle timeout.

IP Allow-listing · IP allow-list

Not currently available

Restrict workspace access to allow-listed IP ranges — not built.

Device Trust · Device posture

Not currently available

Managed/trusted-device posture checks at sign-in — not built.

Role-Based Access Control · RBAC

Available

Workspace roles with a documented permission matrix; enforced in UI and by RLS at the data layer.

Enterprise Directory · Directory

Available

Per-organization member roster with roles and invited/active status; directory sync via SCIM is enabled per organization during onboarding.

Access Reviews · Access certification

Planned

Periodic review/recertification of member access and roles — planned.

Session & Access Audit · Audit

Available

Append-only audit of access-relevant actions, plus an identity security log for enterprise organization administrators.

Invite Flow · Provisioning

Available

Owner invites members (invited → active) via the accept-invite flow; role assigned at invite.

Federation

SSO Protocol Support

Protocol	Status	Target IdPs
SAML 2.0	Planned	Okta, Microsoft Entra ID, Ping, OneLogin
OpenID Connect	Controlled activation	Entra ID, Google Workspace, Okta
SCIM 2.0	Controlled activation	Okta, Entra ID (user/group sync)

ProtocolSAML 2.0

StatusPlanned

Target IdPsOkta, Microsoft Entra ID, Ping, OneLogin

ProtocolOpenID Connect

StatusControlled activation

Target IdPsEntra ID, Google Workspace, Okta

ProtocolSCIM 2.0

StatusControlled activation

Target IdPsOkta, Entra ID (user/group sync)

Authorization

RBAC Matrix

The role → permission matrix enforced across the workspace (and at the data layer via RLS).

Permission	Owner	Compliance Officer	Risk Manager	Auditor	Viewer
Manage Organization	✓	—	—	—	—
Invite Members	✓	—	—	—	—
Edit Member Roles	✓	—	—	—	—
Upload Evidence	✓	✓	—	—	—
Review Evidence	✓	✓	✓	✓	—
Create Remediation Actions	✓	✓	✓	—	—
Close Remediation Actions	✓	✓	—	—	—
Generate Reports	✓	✓	✓	✓	—
View Audit Trail	✓	✓	✓	✓	—
Manage Regulatory Submissions	✓	✓	—	—	—

Owner: Full access. Manages workspace setup, entities, and pilot activation.

Compliance Officer: Manages remediation actions, evidence, and regulatory submissions.

Risk Manager: Reviews risk scores, alerts, and audit readiness. Cannot change workspace settings.

Auditor: Read-only access to evidence, audit packages, and reports for independent review.

Viewer: Read-only access to dashboards and reports. Cannot take any action.

Controls

Identity Policies & Session Controls

Identity Policies

Password authenticationAvailable

MFA required (per tenant)Controlled activation

Step-up for sensitive actionsAvailable with limits

IP allow-listingNot currently available

Device trust / postureNot currently available

SSO-only enforcementControlled activation

Session Controls

JWT session verification (server-side)Available

Explicit sign-outAvailable

Revoke other / all sessions; administrator revocationAvailable with limits

Absolute session age (per-tenant policy)Controlled activation

Idle timeout (client-side, pilot workspace)Available with limits

Server-side idle timeoutNot currently available

Concurrent-session limitsNot currently available

Lifecycle

Directory, Invite Flow & Access Reviews

Invite Flow

Available

1. Owner invites a member by email and assigns a role.
2. Member record is created with status 'invited'.
3. Member accepts via the accept-invite flow and is set to 'active'.
4. Access is governed by the assigned role (RBAC) and RLS.

Access Reviews

Planned

Cadence: Periodic (recommended quarterly) + on role change

• Member roster vs intended access
• Role appropriateness (least privilege)
• Removal of departed members
• Owner/admin role concentration

Statuses: Available · Available with limits · Controlled activation (enabled for your organization during onboarding or configuration) · Early Access · Planned · Not currently available. Authentication and tenant isolation (Supabase Auth + RLS) are the security boundary. Decision-support — not legal advice.