Security, privacy and trust

SAML 2.0 and OIDC single sign-on, with just-in-time provisioning and mapping from identity-provider groups to platform roles. SCIM 2.0 provisions and deprovisions both users and groups, so a leaver is removed by your directory rather than by someone remembering.

Multi-factor authentication uses an authenticator app, with an email one-time code as an optional fallback your organization can enable, and recovery codes. Step-up MFA re-challenges the user before destructive or structural actions, so a stolen session cannot quietly delete a register.

Optional IP allowlists restrict where your environment can be reached from once your administrators add rules, and active sessions are visible and revocable.

Granular role-based access control over sixteen built-in roles, each scoped along the folder and perimeter tree defined in Governance. A business unit head sees their unit; a control owner sees their controls.

Segregation-of-duties rules prevent the same person from performing conflicting actions, and the risk acceptance matrix defines who may accept what level of exposure.

External auditors get their own role, assigned to the folders their engagement covers, so they see the evidence in that scope and nothing beyond it. Remove the assignment when the engagement ends.

An immutable audit log records every state change with the actor, the before and after values, and a timestamp. It is the record you hand an auditor when they ask who changed a risk score and when.

Exports produce their own audit record, so knowing who took the risk register out of the platform is itself answerable.

A configurable multi-stage approval workflow runs across modules: Owner, then Reviewers, then Approvers, then Attestations. It defaults to line-manager approval and is reusable rather than rebuilt per module.

A unified approvals inbox with a live badge means the thing waiting on somebody is visible to them rather than sitting in a queue they do not check.

Data is encrypted in transit and at rest. Connector credentials are held in per-tenant secret storage, encrypted, and never shared across tenants.

Backups and exports are tenant-scoped. Per-tenant SMTP means your notifications leave your own domain rather than ours, which matters both for deliverability and for what your users see in the from field.

The AI Copilot is gated on a per-tenant, verified AI provider. You choose the model and where it runs, including a model running entirely inside your own network. The Copilot stays disabled until a tenant verifies its own provider.

Each tenant has its own AI configuration and its own retrieval index, which covers the platform knowledge base and your own content. Questions and answers are logged in the platform for audit, and per-tenant usage reporting shows what was consumed.

The Copilot queries through a defined tool layer rather than free-associating, and every draft and suggestion is reviewable before it changes a record.

TrustPoint runs as multi-tenant SaaS, in your own private cloud subscription and region, or fully on-premises and air-gapped.

In the air-gapped shape, licence activation is Ed25519-signed and works fully offline, content packs install by signed manual upload, and continuous control monitoring connectors run inside the platform on your network. There is no phone-home requirement.