Every feature here is in the open-source build. There is no paid tier for identity, access control or auditing.
Each member has one role per organization. Permissions are checked on the server for every request. Someone who is not a member of an organization gets "not found", so ids cannot be probed.
| Role | Can |
|---|---|
| Owner | Everything, including deleting the organization. An organization always keeps one owner. |
| Admin | Manage members, projects, keys and settings. |
| Billing | Manage plans and invoices; read everything else. |
| Member | Work with issues, insights, flags and dashboards. |
| Viewer | Read everything; personal data stays masked. |
Custom roles pick exactly which resource:action permissions they grant. Nobody can create or assign
a role with permissions they do not hold themselves.
Teams group members and are given access to projects. When an owner turns on restrict projects to teams for the organization, members see only the projects their teams have; owners and admins still see every project.
Under Settings, Security, connect any OpenID Connect provider (Okta, Microsoft Entra ID, Google Workspace, Keycloak and others). Sign-in uses PKCE and a nonce, and each sign-in link works once.
- Add your email domain and publish the TXT record shown, then verify it.
- Enter the provider's issuer URL, client id and client secret. The secret is stored encrypted.
- Optionally enforce SSO, so members of the domain must sign in through your provider, and turn on automatic joining with a default role.
Create a SCIM token under Settings, Security and give your identity provider the base URL
https://<your host>/scim/v2 with that token. Users and groups follow your directory: people added
there join, people removed there lose access. The token is shown once and stored only as a hash.
Members can add an authenticator app under Settings, Password and 2FA. Owners can require 2FA for the whole organization; members without it are asked to set it up before they continue.
API keys start with tlk_, act for the person who created them, and carry only the permissions and
projects chosen at creation, never more than that person holds. They are stored as hashes and shown
once. Use them with Authorization: Bearer tlk_....
Every change to an organization, member, role, team, project, key, domain or security policy is written to the audit log in the same transaction as the change, so a change cannot happen without its record. Owners and admins read it under Settings, Audit log.
Data stays in your Postgres and ClickHouse. AI features are off until an owner turns them on and chooses a provider. Prompts have emails, tokens and other personal data removed before they leave your server, and Preview what is sent shows the exact text first.
See SECURITY.md.