13.1
Admin
Existing credentials, no new password.
Single Sign-On configures against your identity provider so employees sign in with the credentials they already have — and leave when your directory says they have left.
Single sign-on
Connected
Provider
Azure AD
Protocol
SAML 2.0
MFA
Enforced by provider
Provisioning
SCIM · nightly
Deprovisioning follows your directory, not a manual list.
13.2
Admin
Every action, on the record.
Activity Logs keep an audit trail of user actions, system events, and configuration changes — the answer to who changed this, and when.
13.3
Admin
See where and when access happened.
Authentication Logs monitor sign-in activity — successful, failed, and from where — so unusual access is visible rather than inferred.
Authentication
7 days
Sign-ins
1,842
Failed
23
New devices
11
A. Okafor
SSO
Toronto
R. Mensah
SSO
Hamilton
Unknown
Failed ×4
Blocked
13.4
Employee
Anonymity that holds in the record itself.
Anonymous Reporting Protection accepts a report without capturing identity at all — so anonymity is a property of the data, not a promise about who will look.
13.5
All roles
Evidence stays private to the people handling it.
Secure Document Handling stores uploads and case evidence privately, serving them only to the people authorized for that case.
Document access
witness-statement.pdf
Case ETH-0142
2 reviewers
shift-roster-june.pdf
Hazard HZ-0311
1 reviewer
Encrypted at rest and in transit
Access checked per request
Every retrieval logged
