For IT, security, and the teams who report at scale
Built for the teams that report at scale.
SAML SSO, SCIM directory sync, customer-managed keys through AWS, Azure, Google Cloud, or HashiCorp Vault, an append-only hash-chained audit log, contracted data residency, and custom-domain delivery. Every report under enterprise governance from day one.
- GDPR
- SAML SSO + OIDC
- SCIM 2.0
- BYOK encryption
- Row-level security
- Immutable audit log
- EU-hosted
Article I — Identity & accessp. 2
Plug into your IdP. We follow your security policy, not ours.
Rahoto speaks SAML 2.0, OIDC, and SCIM 2.0 out of the box. Verified domains can enforce SSO so password login is blocked. Conditional access policies (IP allowlists, domain-pinned MFA) attach at the org level. Break-glass admin grants are time-boxed and every action is signed into the audit log.
SAML 2.0 SSO
Okta, Azure AD, Google Workspace, OneLogin, custom IdPs. JIT provisioning.
OIDC SSO
Standard OIDC metadata discovery + JIT provisioning.
SCIM 2.0 directory sync
Users, groups, role mapping. Per-org tokens hashed at rest.
Conditional access
IP allowlists, enforced SSO per domain, session policies.
API keys with TTL
Named keys, scoped permissions, expiration. Revocable from admin UI.
Break-glass admin
Time-boxed emergency grants. Every action recorded and reviewable.
Architecture & trust boundaries →STRIDE threat model →Remediation SLAs →
Article II — Data security & residencyp. 3
Your data stays where it lives. Encrypted with the key you control.
Rahoto sits on top of your warehouse — your data does not leave it unless a published report needs it. Field-level encryption with bring-your-own-key across AWS KMS, GCP Cloud KMS, HashiCorp Vault, or our platform default. Per-org data residency pins where compute and storage happen. Connections into networks you control are secured with client-certificate mTLS, with certificate material encrypted at rest per organisation.
BYOK across 4 KMS providers
AWS KMS, GCP Cloud KMS, HashiCorp Vault, or platform default. Per-org rotation.
Field-level encryption
AES-256-GCM. Credentials, sensitive columns encrypted with your org key.
PII redaction
Column classification, automatic masking in renders, logs, and audit events.
Data residency
Contracted EU or US storage regions, with provider allowlists enforced at runtime.
mTLS connector security
Client-certificate mTLS on connections to your databases, per-org.
FIPS mode
Detected at boot. Enforceable per-environment. Required for GovCloud deploys.
Sub-processor list →Architecture & trust boundaries →STRIDE threat model →
Article III — Audit & evidencep. 4
Every action signed. Every chain verifiable. Every record exportable.
The audit log is append-only and hash-chained — each entry references the hash of the previous, making tamper impossible to hide. A daily integrity job walks the chain and alerts on any break. Publication changes, role changes, secret access, schedule edits, and data access all flow into the same log. GDPR data subject requests have a dedicated workflow.
Hash-chained audit log
Append-only. Daily integrity verification. Tamper-detection alerts.
9 core audit event types
Login, role change, quota override, publication, secret access, session revoke, and more.
Publication audit trail
Schedule, targets, variants, policies, retention — every change attributed and timestamped.
Data access log
Field-level access tracking for auditors and DSR investigations.
GDPR Data Subject Requests
Built-in workflow for export and deletion. Audited end-to-end.
Continuous monitoring
CM-6/CA-7-style beacons to any Splunk HEC-, Qualys-, or Tenable-compatible webhook.
Remediation SLAs →Architecture & trust boundaries →All compliance documents →
What ships in the boxp. 5
Thirty-six enterprise capabilities. Already in production.
Every item below is shipped code — not roadmap. The links in each article above point to the source documentation. Onboarding does not depend on us shipping anything new for you.
Authentication
- SAML 2.0
- OIDC
- SCIM 2.0
- Conditional access
- API keys with TTL
- Enforced SSO per domain
Authorization
- RBAC · 5 roles
- Per-resource permissions
- PostgreSQL RLS
- Org isolation
- Workspace membership
- Break-glass admin
Data security
- BYOK · 4 providers
- Field encryption
- PII redaction
- Secret rotation
- FIPS mode
- mTLS connector security
Audit & compliance
- Hash-chained log
- Audit export (JSON/CSV)
- GDPR DSR workflow
- Data access log
- Continuous monitoring
- Public Trust Portal
Operations
- Per-org quotas
- Custom domains
- Delivery receipts
- Cancellation control
- Preflight gates
- Org-level metrics
Reliability
- Redis-backed shared state
- Artifact recovery service
- S3 versioned artifacts
- Replay-on-reconnect
- Periodic snapshots
- Audit DR plan
Architecture at a glance
Sits on your stack. Doesn't replace it.
Rahoto reads from your warehouse or semantic layer, composes the report in our runtime, delivers it to your channels. Your data doesn't leave its home unless a published report needs it. Six trust boundaries documented and verified.
Read the full architecture (with trust boundaries, identity sources, key services, and operational hooks) in ourpublic architecture document.
- Your warehouseSnowflake, BigQuery, Redshift, Postgres, SQL Server, Oracle…
- Semantic layer (yours, optional)dbt, Cube, Looker semantic models
- Rahoto runtimeCompose, validate, render, audit
- Delivery surfacesSlack, email, PDF, custom-domain viewer, embedded
Procurementp. 6
We can answer the questionnaire.
Contracts
- Custom MSA on request
- DPA template available on request
- Net-30 / Net-60 / annual billing
- Order forms via DocuSign
Pricing
- Custom annual workspace or platform pricing
- Portfolio terms for multi-workspace rollouts
- Annual prepay discount
Implementation
- SSO + SCIM wired in your first session
- BYOK configured before first production report
- Custom-domain delivery in week one
- Migration help from existing tools
Security questionnaire
- STRIDE threat model (public)
- Architecture doc (public)
- Remediation SLAs (public)
- Sub-processor list (public)
Bring your runtime under enterprise control.
Talk to our enterprise team about your data perimeter, identity stack, and reporting calendar. We'll work out residency, BYOK, and SCIM mapping before you sign anything.
Prefer email? [email protected]