Authentication
- Passwordless email verification and WebAuthn passkeys are implemented.
- Enterprise SAML 2.0 supports signed and encrypted assertions, replay protection, mapped upstream MFA, and step-up policy.
Security
OASIS applies identity, authorization, data-protection, audit, and operational controls across the tenant boundary and the actions teams take inside it.
Reviewed September 15, 2026
Control details
Authorization
- Scoped role-based access control covers organization, business unit, brand, social account, campaign, content, report, dashboard, topic, source, and data-classification boundaries.
- Explicit denies take precedence.
Tenant isolation
- Application and repository access is organization-scoped.
- Asset keys and private object-storage paths are tenant-scoped, and isolation behavior is covered by automated tests.
Encryption
- Production traffic is HTTPS-only with HSTS.
- Production database connections require verified TLS.
- Sensitive provider credentials, records packages, and approved report artifacts use authenticated AES-256-GCM encryption with tenant and purpose context.
Sessions
- Session cookies are HTTP-only, secure in production, and SameSite=Lax.
- Sessions can be rotated and revoked; sensitive account changes require fresh verification.
Audit
- Access changes, approvals, publishing, exports, deliveries, AI use, and data corrections write actor, request, and target context to append-only audit records.
Application security
- Production responses include CSP, frame denial, MIME-sniffing protection, a restrictive permissions policy, and a strict referrer policy.
- Dependency and source scanning are implemented; DAST is a roadmap control.
Resilience
- Backup and disaster-recovery controls target a 24-hour recovery point and an 8-hour recovery time.
- Business-continuity controls target restoration within 24 hours.
Important: These controls describe the current OASIS application design and verified implementation. No third-party certification is claimed.