Security at Azora
Bring teams into one workspace while keeping access tied to the person, their organization and the record they need.
Explore the controls behind sign-in, record access and internal approvals. Then review how they apply to your team's workflow.
Controls with a practical purpose
Start with what your team needs to control, then inspect the policy and workflow behind it.
Users can enable authenticator-based two-factor authentication. An organization policy can require setup before application access, with single-use backup codes for recovery.
Access can require more than the password alone.
Tenant-scoped data access uses the signed-in person's account context. Server-side role and record rules govern access to protected work.
Sharing a platform does not give a colleague unrestricted access to its records.
Session checks compare account status, organization membership and revocation state. Password changes and account suspension can end existing access.
Access decisions can reflect changes after the initial sign-in.
Supported controlled-record workflows retain the actor, time and record history. Signed decisions bind the signer to the record and the action being taken.
Review the decision and its context when the work needs to be explained.
See control in the software
In supported internal signing workflows, the signer confirms their identity and intent against the record being reviewed.
The image shows SOP-014 v2.0, its revision notes and the pending sign-off chain.
The internal signing ceremony asks for the password again, plus an authenticator code when two-factor authentication is enrolled.
Supported signing workflows keep the signer, meaning, reason and time with evidence of the committed record.
A closer look
Use these answers to start the conversation about your users, records and deployment requirements.
Yes. An organization policy can require users to complete authenticator setup before application access. Enrolled users use an authenticator challenge at sign-in; single-use backup codes provide a recovery option.
Review the rollout and recovery process with your administrator when setting the policy.
Azora encrypts newly stored authenticator setup and active TOTP secrets with AES-256-GCM. Backup codes are stored as hashes.
This describes that specific application control. Review database, file, backup and key-management arrangements separately for the hosting setup you choose.
Supported controlled-record histories include the record, actor, time and applicable field changes. Known secret fields are excluded from field diffs; designated sensitive HR records retain changed field names without copying their values.
The fields and events retained depend on the record type. Include your specific records in the review.
Browser-session checks use a 30-second cache, so revocation is not an instant guarantee across every session. During database errors, a previously validated session may also use a ten-minute grace window measured from its last successful validation.
If immediate revocation is a requirement for your organization, include that requirement in the security review.
Bring your access model, sensitive record types, hosting needs and security questionnaire. Agree which controls, configuration and evidence apply to your intended use.
If you require an independent assurance report or certification, ask us to confirm the current documents and their scope. Product controls alone do not establish your organization's compliance.
Evaluate the fit before you commit
Roles, authenticator policy, account changes and recovery.
Access boundaries, approvals, retained history and sensitive information.
Hosting, backups, recovery expectations and required assurance evidence.
Email opens in your email app. Include your questionnaire or describe the workflow you want to review.