Security Configuration

This guide covers the security controls you should enable in production: multi-factor authentication, encryption, audit logging, and network restrictions.

Authentication hardening#

• Enforce MFA for all direct accounts (SSO users inherit your IdP's MFA).
• Set session timeouts and IP allow-lists for the console.
• Use short-lived, scoped API tokens instead of long-lived credentials.

Encryption#

All agent-to-server and browser-to-server traffic uses TLS 1.2+. Data at rest is encrypted on the storage volume; bring your own KMS key for envelope encryption in regulated environments.

Audit logging#

Every administrative and security-relevant action — logins, role changes, token creation, runbook execution — is recorded in an immutable audit log you can stream to your SIEM via webhook or the API. See the Security overview for the platform's posture.