Appearance
Security Overview
Access control on a Zernio team: sign-in methods, roles, sessions, and the audit log. This page covers access control only. Certifications and data handling (SOC 2 Type II, GDPR documentation) come with the Enterprise track.
Signing in
- Email & password: screened against public breach corpora via the haveibeenpwned k-anonymity API (only the first 5 characters of a SHA-1 digest ever leave your browser). Supports two-step verification.
- Google OAuth: keyed to a stable Google account ID.
- GitHub OAuth: keyed to a stable GitHub account ID.
- Enterprise SSO (SAML/OIDC): Enterprise plan only.
Sessions and devices
Every active session is listed with its device. You can sign out a single device or use "sign out everywhere" to end all sessions at once.
Team roles
Five tiers, each scoped down from the one before it:
| Role | Access |
|---|---|
| Owner | Full access, including billing and API keys |
| Admin | Team management and activity logs, cannot transfer ownership |
| Billing Manager | Payments and invoices only |
| Member | Product usage within an assigned scope |
| Viewer | Read-only |
Profile scoping further restricts what a Member or an API key can see or touch, down to specific profiles.
Audit log
Every team-management action writes an append-only audit entry: invites, removals, role changes, and ownership transfers. Only the Owner can access it.
Enterprise controls
- SAML/OIDC identity-provider connection with DNS verification.
- SSO enforcement by email domain.
- SCIM 2.0 directory sync.
See also
- Multi-Tenant Architecture: scoped API keys and per-profile access control for platforms built on top of Zernio.
- Two-Step Verification: TOTP and backup codes for password sign-in.