Application Security

The relay page covers the scanner that runs in your Azure subscription. This page covers the Calibrant web application itself.

Sign-in: SSO only, no passwords

Calibrant has no password database. Sign-in is exclusively through Microsoft or Google single sign-on, so your organization's own identity provider — including its MFA and Conditional Access policies — governs access to Calibrant. Sessions use short-lived tokens in secure cookies, refreshed and validated server-side on every request.

Workspace isolation

Customer-readable tables use database row-level security keyed to the workspace, and new tables begin closed to browser roles. Private operational tables are not granted to signed-in users. A small number of server-only workflows use a service credential only after the caller and workspace are verified, with reads bound to the specific tenant and record requested. These database controls reduce reliance on application filtering, but no software control is an absolute guarantee against every defect.

Invite-gated membership

New members join a workspace only by invitation from an existing admin, and invitations are domain-checked. Calibrant does not send invitation emails yet; the administrator must share the invitation with the intended person through a separate channel. Roles separate who can run scans and manage settings from who can only view results. Machine endpoints (scheduled jobs, relay traffic) authenticate with dedicated secrets and are isolated from user sessions.

Transport and secrets

All traffic is TLS. Provider secrets are stored in an encrypted vault, relay API keys are per-relay and rotatable, and webhook endpoints verify signatures before acting.

Auditability

Consent acceptances (terms, data access, scan disclaimer) are recorded with document version, timestamp, IP, and user agent. Scan history records who launched what and when, and the relay's own log on your VM records the SHA-256 hash of every script it executed — provenance that stays in your boundary. The reported hash can be compared with a known-good release, but it is not remote attestation of a compromised VM.

Reporting a vulnerability

If you believe you have found a security issue in Calibrant, email security@calibrant.ai. We respond to security reports as priority work, and we ask that you give us a reasonable window to fix an issue before public disclosure.