SSO and audit export

Single sign-onCopy Anchor Link

SSO is available on the Scale plan. It uses SAML 2.0 through Supabase Auth, so the identity provider is registered once per project and then linked to a organization.

1. Register the identity provider with the Supabase CLI: supabase sso add --type saml --metadata-url <url> --domains example.nl. The command prints a provider id.
2. In Settings → Security, enter the provider id and the email domains that belong to it.
3. Optionally turn on Require SSO for these domains.

On the login page, members enter their work email under Company single sign-on and choose Continue with SSO; SignalDock looks up the provider by domain and redirects to it.

EnforcementCopy Anchor Link

With enforcement on, a member whose email matches a listed domain must have signed in through SSO. Sessions created with a password or magic link are detected from the token's amr claim and sent back to the login page with a prompt to use SSO. Members outside the listed domains, such as external consultants, keep their usual sign-in.

Only owners and admins can change SSO settings, and every change is written to the audit log.

Audit exportCopy Anchor Link

Growth and Scale organizations can download the audit log from Settings → Security, or through GET /api/compliance/audit/export.

The export is a CSV of up to 10,000 events, oldest first, with the columns created_at, actor_kind (user, agent, or system), actor_id, action, subject_kind, subject_id, and details (JSON). Pass from and to timestamps to export a range; because rows are oldest first, a large log can be exported in batches starting from the last created_at. It covers approvals, sends, suppressions, data-subject requests, and settings changes. Cells that start with =, +, -, or @ are prefixed so spreadsheets do not run them as formulas. Each export is itself recorded as an audit event.

RelatedCopy Anchor Link

• Compliance: what the audit trail records
• Billing and usage: which plans include these features