Security architecture

Consent, pushed requests, backchannel authentication, passkey ceremonies, logout, and token issuance run on the Rust auth plane. Not in browser code.

Global identity sessions and tenant-scoped dashboard sessions are distinct. The public site owns neither.

Tenant branding appears on hosted auth and trust surfaces only. Product shells remain SigID-owned.

Applications, operators, billing, and policy changes are logged and surfaced as reviewable operator controls.

Vaulted third-party credentials are attached to outbound requests at the egress boundary, so agents exercise secrets they can never read or exfiltrate. Grants are scoped and revocable; the open-source egress can run in your own network so SigID never sees workload traffic.