This article covers the identity, monitoring and access controls iplicit uses to protect customer data from unauthorised access.
Identity and access
iplicit supports single sign-on via SAML 2.0 and Microsoft Entra ID, and Multi-Factor Authentication (MFA) is supported and strongly recommended.
Within the application, a Role-Based Access Control (RBAC) system lets customer administrators assign granular permissions based on job function, so users only access data relevant to their role.
Internally, iplicit operates a Zero Trust architecture. Engineers hold no standing access to production systems - access is granted just-in-time through Azure Privileged Identity Management, for a limited period, and is fully audited.
Monitoring and detection
iplicit's production environment is monitored continuously using Microsoft Sentinel and Microsoft Defender for Cloud, including User and Entity Behaviour Analytics (UEBA) to detect abnormal activity such as access at unusual hours or unexpected large-scale data downloads.
Incident response
If suspected unauthorised access is confirmed, iplicit's incident response team follows a defined process to contain, investigate and resolve the issue.
Security measures
Unauthorised access
Data security
Access control
Incident response