Built for enterprise trust
AssetScope is architected for the access, isolation, and auditability that mission-critical operators require. Below is an honest map of what is in place today and what is on the roadmap — no checkbox theater.
Identity & access
- SSO — OIDC / SAMLAvailable
Enterprise single sign-on via your identity provider; the production auth path.
- SCIM 2.0 provisioningAvailable
Per-tenant user provisioning and de-provisioning so access tracks your directory.
- Session securityAvailable
HMAC-signed sessions and scrypt password hashing for credential-based access.
Authorization (RBAC)
- Role-based access controlAvailable
Four roles — Owner, Admin, Reliability Engineer, Viewer — enforced on every mutation and UI affordance.
- Least privilegeAvailable
Viewers are read-only; audit is admin-only. Permissions are checked server-side, not just hidden in the UI.
Multi-tenancy & isolation
- Org-scoped isolationAvailable
Every record is organization-scoped; cross-tenant access guards prevent data from leaking across tenants.
- Per-tenant configurationAvailable
SSO, SCIM, alerting, and data live within the tenant boundary.
Auditability & monitoring
- Append-only audit logAvailable
Security-relevant actions are recorded immutably with actor, target, and context.
- SLO alertingAvailable
Per-vertical error-budget burn-rate alerting with Slack / PagerDuty delivery.
Data protection
- Encryption in transitAvailable
All traffic is served over TLS; machine endpoints are authenticated.
- Condition-data onlyAvailable
We process operational, condition-based telemetry. The healthcare connector transits device-condition metrics only — never PHI.
- Encryption at rest (managed deployment)Roadmap
Database-level encryption at rest on the managed Postgres path.
Platform resilience
- Distributed rate limitingAvailable
Redis-backed, fail-open rate limiting plus request-size limits protect the API surface.
- Tenant-safe scaleAvailable
Deterministic large-fleet handling (load-tested to 100k-asset scale on synthetic fleets) with sharding.
Persistence
- Pluggable storageAvailable
File backend by default with a PostgreSQL/Prisma path behind one interface — a backend swap is an env change, not a rewrite.
Compliance
- SOC 2 readinessAvailable
A SOC 2 readiness map with machine-readable evidence export is in place.
- SOC 2 Type II reportRoadmap
Formal Type II examination is planned as part of the enterprise rollout.
Need our security questionnaire, architecture details, or a data-processing discussion for an evaluation?
This page describes the platform's security architecture. “Roadmap” items are planned and not yet generally available. Formal attestations and a data-processing addendum are provided as part of an enterprise engagement.