Security

Single sign-on

Enterprises can require SSO for every seat, provision and deprovision through SCIM, and audit any support impersonation.

What you get

Your identity provider, your policies

SAML and OIDC

Connect your identity provider and require SSO per agency.

SCIM provisioning

Seats created and removed from your directory, so leavers lose access the same day.

Step-up authentication

A second factor required for sensitive actions such as vault fields and payout approval.

Hardware-key admin access

Admin roles require a YubiKey at sign-in, enforced through your identity provider. Two keys are issued per admin, with a sealed backup held by your security officer.

Role mapping

Directory groups map to Kaffeine roles, so permissions follow the org chart.

Impersonation auditing

Any support impersonation is logged with who, when and what was viewed.

Enterprise

Access that survives an audit

Access reviews answer who could see what, when, and on whose authority, including read-only entry into linked downline agencies.

  • SSO enforced per agency
  • SCIM create and deprovision
  • Step-up on sensitive actions
  • Impersonation and access logs

Ask us how this would work for you

We'll show the integration running on your own numbers, carriers or systems.