Enterprise
Mandact for organisations
Mandact is built multi-tenant from the ground up: real organisations, role-based rights, single sign-on, and automatic provisioning — the building blocks an enterprise IT department asks for before going live.
Organisations & roles
Real tenant separation at database level (org_id, row level security). Five roles — Owner, Admin, Issuer, Auditor, Developer — with role-bound write access: an Auditor reads the evidence chain but issues no mandates.
Single sign-on (OIDC via Supabase)
Domain-based login routing: your users sign in through your identity provider (Okta, Entra ID, Google Workspace). No separate password, central deactivation through your IdP.
SCIM 2.0 provisioning
Automatic creation and deactivation of users straight from your IdP (RFC 7644). Endpoints under /scim/v2/Users; bearer token per organisation. De-provisioning revokes access immediately.
Tenant-separated evidence chain
Every verification, every mandate, every audit export is bound to the organisation. No cross-organisation visibility — enforced by RLS, not hoped for in application code.
SCIM endpoints
Authentication via an organisation-specific bearer token (Authorization: Bearer scim_…). Tokens are stored hashed and can be revoked at any time.