Controls for organizations on the Enterprise plan: single sign-on, user provisioning, network and session policy, and an exportable audit log. Status: rolling out unless marked otherwise.
Single sign-on (rolling out)
- Organization members sign in with OIDC or SAML 2.0 single sign-on, with verified email domains.
- Sign-in looks up the organization from the member's email domain, so members do not need a special link.
SCIM provisioning (rolling out)
- SCIM 2.0 user and group provisioning at the
/api/scim/v2path of the Forge64 API. - Your identity provider authenticates with a bearer token issued for your organization. The token works only on the SCIM endpoint, never as a sign-in session.
- Requests are rate limited per token and per organization, and repeated failed authentication is throttled.
IP allowlists and session policy (rolling out)
- Restrict your organization to a list of IP addresses or ranges.
- Set a session policy for your members.
- The organization owner has a break-glass code that works from any IP address, so a wrong allowlist cannot lock the owner out. The code is shown once and can be rotated.
- Tightening these controls needs the Enterprise plan; relaxing them never does, so a downgraded organization can always undo its own restrictions.
Audit log and export
- Billing and project changes are written to a hash-chained audit log; verification detects an edited or removed entry.
- Organization admins can export the audit log as JSON or CSV. CSV cells that look like spreadsheet formulas are escaped so opening the file cannot run them.
Coming soon
- Coming soon: customer-selectable data residency. Today all data is stored in one region.