Security

Controls

• Single sign-on via Microsoft Entra ID + Argon2id email/password fallback
• Passwordless magic-link sign-in (single-use, 15-minute token TTL)
• Two-factor (TOTP) self-enrollment with role-based MFA enforcement for privileged accounts
• Org-level admin policy: SSO-only, invite-only, allowed email domains, MFA-by-role
• Risk-based step-up: new device or privileged role triggers automatic MFA challenge
• Lifecycle controls: suspend / reactivate / deprovision atomically revoke all active sessions
• All secrets resolved at runtime from Azure Key Vault — no plaintext in CI
• Per-organization row-level isolation enforced at the DAL layer
• Mandatory hash-chained audit trail on every mutation
• Append-only auth audit log with 25+ event types (signup, login, MFA, lifecycle, policy)
• Container images scanned with Trivy (CRITICAL gate) on every build
• Dependency audit + Snyk + secret-scan workflows on every PR
• Account lockout after 5 failed attempts (15-minute window) plus risk-based soft-lockout
• Privilege escalation, RLS and cross-org breach contract tests

Audits & certifications

Nzila is targeting SOC 2 Type II in 2026. Roadmap and interim controls available on request.

Report a vulnerability

See SECURITY.md.