Security and sign-in
No passwords to steal. Every door on record.
What follows is how the product works today, said plainly. Where something is not built, it says so.
Signing in
Emailed links, not passwords
Staff type their work address and receive a one-time link that lives fifteen minutes. There is nothing to reuse across sites, nothing to reset, nothing to phish for. Requests are rate-limited and answer the same way whether or not an address is known.
Microsoft Entra ID single sign-on
A hospital registers StandingDocs in its tenant and staff sign in with the account they already have, under whatever multi-factor policy the hospital enforces. Sign-in is checked against the hospital’s registered email domains; guest accounts from other tenants are refused.
Mixed, then required
Single sign-on is turned on alongside the emailed link, so nobody is stranded while it is tried. When the hospital is ready it can require it. The hospital’s System Admin always keeps the emailed link, so an expired secret never locks anyone out of the place where it is replaced.
Second factor for the people with reach
Anyone who can change who gets in or how, the hospital’s System Admin and our own administrators, must use Google Authenticator and enters a code at every sign-in.
Access and the record
Roles, not permissions to configure
Viewer, Author, Reviewer, Approver, Administrator, and the organization’s System Admin. A person may hold several. Every action is checked against the record on the server, never against what the browser claims.
One hospital, one organization
Each organization’s data is its own. A person who works at two hospitals chooses which one to open. Nobody at one can read another’s.
Audit log
Changes to policies, people and settings are written with who, when and what changed, retained, and exportable for a survey.
Encryption
Data is encrypted in transit and at rest on Google Cloud. Identity-provider secrets are held in a secrets manager, never shown again after entry.
Not built yet, said plainly
Automatic de-provisioning from the identity provider (SCIM): removing a leaver is done on the Staff page. Group membership is mapped to roles at each sign-in, not synchronized on a schedule. We do not currently hold a third-party security certification; ask us and we will tell you exactly where things stand.