The answers your security reviewer is going to ask for

Authentication

Single sign-on

OpenID Connect, authorisation code flow with PKCE (S256). The implicit and hybrid flows are not implemented. ID tokens are accepted only when signed with an asymmetric algorithm from the provider's published keys; none and the HMAC algorithms are refused. Issuer, audience, expiry and nonce are all checked, and the azp claim as well when a token carries more than one audience.

Provider discovery

Discovery and token requests resolve the hostname first and refuse private, loopback, link-local and IPv6-mapped addresses, then connect to the address that was validated rather than re-resolving it. An administrator cannot turn the configuration screen into a way of reaching your internal network.

Who an SSO login is allowed to become

A federated login is matched to an existing account only when the subject is already known, when the person is already a member of the organisation, or when the organisation has proved control of the email domain with a DNS record. An email address alone is never enough to take over an account.

Passwords, where they are still used

scrypt with a per-user salt and a cost of 2¹⁶, verified in constant time. Sign-in and registration return the same response for a known and an unknown address, so neither can be used to enumerate who has an account.

Sessions

Opaque random tokens in an HttpOnly, SameSite cookie, marked Secure in any deployment served over HTTPS. The database holds a keyed hash of the token rather than the token, so a copy of the database does not let anyone sign in as your users.

Authorisation and separation

Capabilities, not screens

Owner, administrator, author, reviewer and reader each map to a set of capabilities. Every request is checked against that set on the server. Hiding a button is a courtesy to the user, never the control.

Tenant isolation

Every query is scoped by the tenant resolved from the session, and identifiers are not guessable across organisations. Reader-visible responses omit fields — owners, reviewers, internal-only sections — that would disclose people or content the reader is not entitled to.

Catalog portals are read-only

A request that arrives on a portal hostname carries a reduced capability set, so authoring and administration are refused at the API even for a user who holds those rights in the main application. The hostname decides which organisation; the session still decides access.

Custom domains

A domain has to be proved with a DNS TXT record before it will serve an organisation's catalog, and certificates are only issued for domains that have passed that check.

Your data

Where it lives

Wherever you run it. Self-hosted, Imsenta is a container and a volume; the storage layer is a driver interface with SQLite and Postgres implementations, so moving between them is configuration rather than migration work.

Secrets at rest

Identity provider client secrets and similar values are sealed with AES-256-GCM under a key derived per purpose from the instance secret, so a key used for one thing cannot decrypt another.

Egress

A self-hosted instance talks to your identity provider. It talks to OpenAI only if you switch on drafting assistance and supply a key, and the endpoint for that is validated the same way discovery is. There is no telemetry.

Audit trail

Document, governance and administrative actions are recorded with the actor, the target and the time, and are queryable per organisation. Published versions are immutable: a correction is a new issue, never an edit to an old one.

Getting it back out

Markdown with YAML front matter, PDF, Word, or the whole library as a zip — at any time, without asking us.

Application hardening

• A content security policy, frame-ancestors 'none', and the usual transport and content-type headers, set by default rather than left to the deployment.
• Document content is validated against a schema with explicit depth and size limits before it is stored, and dangerous keys are stripped, so a crafted import cannot poison an object prototype or exhaust the server.
• Links and images are filtered to safe schemes on both the HTML and Markdown paths; front matter keys are restricted so imported content cannot forge document metadata.
• The container runs as an unprivileged user, and the test suite includes cases for each of the authorisation and isolation behaviours described above.