> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Product Security - SSO, MFA, RBAC & Audit Logging

> Authentication, single sign-on, role-based access control, API key management, and audit logging in the Corsa compliance platform.

Corsa provides a range of security features that give your team control over who can access the platform, what they can do, and full visibility into everything that happens.

## Authentication

### Multi-Factor Authentication (MFA)

All Corsa user accounts support multi-factor authentication. Administrators can enforce MFA for their entire organization.

* **TOTP** - Time-based one-time passwords via authenticator apps (Google Authenticator, Authy, 1Password).
* **MFA enforcement** - Platform administrators can require MFA for all users before they can access the platform.

### Single Sign-On (SSO)

Corsa supports SAML 2.0-based single sign-on, allowing organizations to centralize authentication through their identity provider.

* Enforce authentication policies centrally through your IdP (Okta, Azure AD, Google Workspace, OneLogin)
* Mandatory SSO mode disables password-based login entirely
* Session management and idle timeout policies controlled by the IdP

### Session Security

* Configurable session timeout with automatic logout

## Access Control

### Role-Based Access Control (RBAC)

Corsa uses granular role-based access control to enforce least-privilege access across the platform.

| Role      | Description                                                                     |
| --------- | ------------------------------------------------------------------------------- |
| **Owner** | Full administrative access. Can manage billing, integrations, and team members. |
| **Admin** | Can manage users, configure settings, and access all compliance data.           |
| **User**  | Standard access to compliance workflows: alerts, cases, clients, transactions.  |

* Roles can be combined with **granular permissions** for fine-grained control (e.g., a user who can view alerts but cannot resolve cases).
* Permission changes take effect immediately - no logout or session refresh required.

### API Key Management

Corsa supports scoped API keys for programmatic access with built-in security controls.

* **Scoped permissions** - API keys can be restricted to specific operations (read-only, write, admin).
* **Key rotation** - API keys can be rotated at any time.

<Note>Never embed API keys in client-side code. Use server-side integrations or the [Corsa SDK](/sdk/installation) for secure access.</Note>

## Audit Logging

Every action in the platform is recorded in a persistent audit log. These logs are designed to support internal compliance reviews, regulatory audits, and incident investigations.

### What's Logged

* **Authentication events** - Logins (successful and failed), MFA challenges, SSO assertions, session creation and termination
* **Data changes** - Status updates, note additions, alert dispositions, case resolutions
* **Configuration changes** - Rule modifications, integration setup, user role changes, API key creation
* **AI agent operations** - Meaningful agent actions such as alert triage, investigation narratives, and due diligence enrichment (see [AI Security](/security/ai-security))

### Retention & Export

* Audit logs are retained for the duration required by the customer's regulatory obligations.
* Logs can be exported for integration with your SIEM or compliance reporting tools.

## Secure Connections

* All traffic to and from Corsa uses **HTTPS with TLS 1.2+**. Connections using older protocols are rejected.
* Webhook deliveries are signed with HMAC-SHA256 so recipients can [verify authenticity](/webhooks/index).
* API responses include security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) to protect against common web attacks.

## Proactive Monitoring

Corsa continuously monitors for suspicious activity and security anomalies.

* **API abuse detection** - Rate limiting detects and blocks API key misuse.
* **Automatic notifications** - Security-relevant events (role changes, API key creation) trigger email notifications to platform administrators.