Security, SSO & Audit

Authentication security

• Passwords hashed with Argon2
• Optional TOTP 2FA on email accounts
• Session list with revoke in Account Settings
• OAuth (Google) and SAML paths supported

SAML SSO (Enterprise)

Configure under Team Settings → SSO:

1. Copy ACS URL and Entity ID (SP metadata) into your IdP (Okta, Azure AD, Google Workspace, etc.)
2. Enter IdP Entry Point, Issuer, and PEM certificate
3. Optional email domain — users with matching emails auto-join the team on first SSO login
4. Enable SSO and save

Users initiate login via organisation domain lookup (/sso/login?domain=…).

Requires: Enterprise plan and Owner-level configuration access.

End-to-end encryption

Decimake supports encrypted attachments with team key exchange, available on every plan. The client provides public key material for wrapped file keys on download.

Audit log (Enterprise)

Route: /teams/:teamId/_audit/

A structured, per-language activity trail for compliance:

• Every entry has a translated action label—Created, Updated, Signed, Assigned Role, and so on—plus a translated detail line built from structured metadata (names, emails, plan/visibility words), not a raw English sentence, so the log reads correctly in French and Bulgarian too.
• Filter by action type; search across actor and detail text.
• Load more paginates through history 50 entries at a time instead of hard-stopping at the last 50 events.

Examples of logged events: invite, remove member, role change, plan change, permission override, decision status change, involvement configuration/position/filter changes, signatures, Slack connect/disconnect, and more.

Team deletion

Owners may Delete Team from settings—permanent removal of spaces, pages, decisions, files, and billing linkage.

Reporting issues

Contact hello@decimake.app or use /contact for security concerns.