Identity and access
Your identity.Your rules.Your access.
Staff sign-in
- User
- Identity provider
- Signed response
- Token validation
- Role assignment
- Secure session
Client sign-in (separate)
- Client
- Entra External ID
- Validated token
- Client console
- Linked projects + public tasks
Clients never need an account in your own directory. They see only the projects they're linked to and tasks marked public. Private tasks are excluded from the client console.
Microsoft Entra ID
Staff on Microsoft 365. Group-based roles, SCIM provisioning.
Google
Staff on Google Workspace. Groups-based roles, directory sync.
AWS Cognito
Identity already in AWS. Staff and customer sign-in via an existing user pool.
Entra External ID
Clients and partners. Passwordless email codes or their own Microsoft or Google account.
- ✓Sift never stores passwords. Passwords, multi-factor and recovery stay with your provider.
- ✓Sign-in uses OpenID Connect and OAuth 2.0, with PKCE.
- ✓Multi-factor and access policies are set in your identity provider.
- ✓Roles: Admin, Manager, Team member, Viewer. New people start at the lowest role.
- ✓Disabling someone in the provider stops sign-in and ends open sessions, in line with the provider's sync behaviour.
- ✓Sign-ins, sign-outs, failed attempts and role changes go to the audit log.
- ✓Multi-organisation installations keep each organisation's data separate.
- ✓Clients join by invitation only. An admin or project lead invites them and links them to specific projects.
- ✓Sessions use a secure, HTTP-only cookie. They end after inactivity and have a maximum length, both set per business, and admins can end anyone's sessions.
- ✓Client secrets and certificates are kept in Azure Key Vault, never in code, and rotated on a schedule.
- ✓All traffic runs over TLS 1.2 or later, with HSTS and strict security headers.
- ✓A custom build runs inside your own Azure account. Your data does not pass through Pulse's systems or any shared platform.
- ✓Automated backups are kept for 7 to 35 days. Backups in a second region are available on request.
- ✓The full source code is available, so your security team can review it.
Sift supports the providers listed above. Security depends on configuration and your provider's policies; no system is beyond attack.
Own the softwareyour team runs on.
Book a free demo today, or talk to us about a custom build in your own Azure account.