Reporting under the controls your security team already runs

SAML SSO, SCIM directory sync, customer-managed encryption keys, an append-only hash-chained audit log, and EU data residency, so every report runs under your security team's controls from day one.

Talk to sales Open the Trust Center

GDPR
SAML SSO + OIDC
SCIM 2.0
BYOK encryption
Row-level security
Tamper-evident audit log
EU-hosted

For the security review

Identity and access

Plug into your identity provider

Rahoto speaks SAML 2.0, OIDC, and SCIM 2.0 out of the box. Verified domains can enforce SSO so password login is blocked, and conditional access policies attach at the org level.

Break-glass admin grants are time-boxed, and every action taken under one is signed into the same audit log as everything else on the platform.

Control	What it enforces	Where configured
SAML 2.0 SSO	Single sign-on through Okta, Azure AD, Google Workspace, OneLogin, or a custom IdP, with JIT provisioning.	Organisation SSO settings
OIDC SSO	Standard OIDC metadata discovery with JIT provisioning.	Organisation SSO settings
SCIM 2.0 directory sync	Users, groups, and role mapping kept in sync from your directory.	Organisation directory settings
Conditional access	IP allowlists, SSO enforced per domain, and session policies.	Organisation security policy
API keys with TTL	Named, scoped, expiring keys, revocable at any time.	Admin console
Break-glass admin	Time-boxed emergency grants; every action recorded and reviewable.	Emergency access controls

Read the architecture and trust boundaries or the STRIDE threat model.

Data security and residency

Your data stays where it lives

Rahoto sits on top of your warehouse. Field-level encryption is bring-your-own-key, and Rahoto runs in the EU, hosted in Helsinki, Finland.

Your data does not leave your warehouse unless a published report needs it.

Connections into networks you control are secured with client-certificate mTLS, with certificate material encrypted at rest per organisation.

Control	Scope	Provider
BYOK field-level encryption	Credentials and sensitive columns	AES-256-GCM under your org key, held in AWS KMS, Azure Key Vault, Google Cloud KMS, HashiCorp Vault, or the platform default
PII redaction	Renders, logs, and audit events	Automatic, by column classification
Data residency	Storage and compute region	EU: hosted in Helsinki, Finland
mTLS connector security	Connections into your networks	Client-certificate mTLS, per-org
FIPS mode	Environment-level	Detected at boot, enforceable per environment

See the sub-processor list or the architecture and trust boundaries.

Audit and evidence

Every action signed, every chain verifiable

The audit log is append-only and hash-chained: each entry references the hash of the one before it, so tampering can't be hidden. A daily integrity job walks the chain and alerts on any break. Login, role changes, quota overrides, publication changes, secret access, and session revokes all flow into the same log, alongside data-access records for field-level auditing.

GDPR data subject requests run through a dedicated export-and-deletion workflow, audited end-to-end. Continuous-monitoring beacons can post to any Splunk HEC-, Qualys-, or Tenable-compatible webhook.

Read the remediation SLAs or all compliance documents.

We can answer the questionnaire

A custom MSA and DPA template are available on request, billed net-30, net-60, or annually, with order forms through DocuSign. Portfolio terms cover multi-workspace rollouts, and annual prepay carries a discount.

Enterprise adds SAML or OIDC sign-in on your verified domain, SCIM provisioning, encryption under your own key, and an exportable audit log that is append-only and hash-chained.

For the security questionnaire, the STRIDE threat model, the architecture document, and the remediation SLAs are all public.

Bring the runtime under enterprise control

Talk to our enterprise team about your data perimeter, identity stack, and reporting calendar. We'll work out BYOK, SSO, and SCIM mapping before you sign anything.