# Security & SSO

GrackerAI is built to meet enterprise security requirements.

---

## Compliance & Certifications

| Certification | Status |
|---|---|
| **SOC 2 Type II** | Active - annual audit |
| **GDPR** | EU data subject rights honoured |
| **CCPA** | California privacy rights honoured |
| **ISO 27001** | In progress |

Request the latest SOC 2 report via [security@gracker.ai](mailto:security@gracker.ai).

---

## SSO (SAML Single Sign-On)

SAML SSO is available on **Scale and Enterprise** plans.

**Supported identity providers:**
- Okta
- Microsoft Entra ID (formerly Azure AD)
- Google Workspace
- OneLogin
- Generic SAML 2.0 IdP

### How to Set Up SSO

SSO configuration isn't a self-serve page in the app today - your GrackerAI account team sets it up with you:

1. Contact [sales@gracker.ai](mailto:sales@gracker.ai) to start SSO setup for your workspace
2. In your IdP, create a new SAML application
3. Share the metadata URL your GrackerAI contact provides with your IdP configuration
4. Map the standard attributes: `email`, `name`, `groups`
5. Test with one user account before enforcing org-wide
6. Once confirmed, your GrackerAI contact enables SSO enforcement to require SSO for all members

**Test before enforcing.** Enabling SSO enforcement before testing can lock users out. Always verify one non-admin account successfully logs in via SSO first.

---

## SCIM Provisioning

Available alongside SSO on **Scale and Enterprise** plans.

SCIM auto-creates new GrackerAI accounts when users are added to your IdP group, and deactivates accounts when they're removed. This eliminates manual seat management for teams with frequent membership changes.

---

## Data Encryption

| Layer | Standard |
|---|---|
| **Data at rest** | AES-256 |
| **Data in transit** | TLS 1.3 minimum |
| **Database backups** | Encrypted - rotated daily |

---

## Access Controls

| Control | Details |
|---|---|
| **Role-based access** | Owner, Admin, Member - see [Team Management](/docs/account/team-management) |
| **Session timeout** | Configurable - default 24 hours |
| **IP allowlisting** | Available on Enterprise plans |
| **Audit logs** | Available on Scale and above - tracks all admin actions |
| **Two-factor authentication** | TOTP-based - strongly recommended for all users, required for Admins |

---

## Vulnerability Reporting

To report a security vulnerability, email [security@gracker.ai](mailto:security@gracker.ai). PGP key available on request.

We follow coordinated disclosure with 90-day timelines before public disclosure.

---

## Next Steps

- [Data & Privacy](/docs/account/data-privacy): retention, deletion rights, and subprocessors
- [Team Management](/docs/account/team-management): manage roles and access controls