Identity & access — Okta / SSO
This track summarizes AlignAI’s security and compliance posture for offline review by your security, privacy, and vendor-risk teams.
This track is a summary for review planning, not a substitute for the underlying policy documents and the SOC 2 report itself. Those are available under NDA — see Vendor portal.
SSO gates every UI sign-in
Every UI sign-in is routed through SSO before it reaches the application — a user authenticates against your identity provider first, and only then reaches the AlignAI front end (Vercel) and back end (Supabase). There is no separate AlignAI username/password path for UI login sitting alongside SSO.
Okta and other SAML-based identity providers
AlignAI works with Okta and other SAML-based identity providers as a standard trusted-app integration. Your identity provider is the authentication gateway: it verifies the user, and AlignAI is the trusted application they’re redirected to once that verification is complete. This is a pass-through pattern — AlignAI doesn’t build custom integration work per identity provider.
User provisioning
SCIM-based automated user provisioning/deprovisioning is not currently supported. Provisioning today happens automatically on first SSO login.
API and MCP authentication
API authentication is separate from UI/SSO authentication. The public API and MCP server authenticate independently via the bearer-token model in Authentication & API keys — they are not gated behind the SSO flow described above.