Skip to main content
Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This page covers how users and integrations authenticate, how access is scoped, and how credentials are protected, rotated, and revoked.

What this page answers

  • Which identity types are used for users and integrations
  • How least-privilege authorization is enforced
  • How credentials are stored, rotated, and revoked

Current state (as of March 5, 2026)

Tero uses enterprise authentication patterns with tenant and workspace scoped authorization. Integration credentials are scoped to required operations and support rotation and revocation.

Authentication and token flow

Authentication model

Access pathModel
User accessSSO and OIDC-capable authentication with session controls
API integrationsScoped token-based authentication
Administrative actionsRestricted administrative access model

Authorization and least privilege

ControlImplementation
Tenant isolationRequests are evaluated in tenant and workspace context
Role-based accessAccess is constrained by role and permitted operations
Scope constraintsIntegration credentials are limited to required functions
Access lifecycleAccess is provisioned for approved need and removed when no longer needed

Credential lifecycle controls

AreaPractice
CreationIssued through controlled integration and admin workflows
StorageCredentials are stored in managed secret systems
RotationSupported on demand and through operational workflows
RevocationImmediate disable and revocation supported
Source control hygieneSecrets are not committed to source code

Hosted vs self-hosted boundary

AreaTero-hostedSelf-hosted
Runtime identity controlsTero-operatedCustomer-operated runtime
IdP policy and lifecycle rulesCustomer-controlledCustomer-controlled
Secret backend ownershipTero-managed servicesCustomer-managed services

Evidence you can request

TopicPrimary evidence
Authentication and password baselineAuthentication and Password Standard
Ownership splitShared Responsibility
Secret handling and key modelEncryption and Key Management
Architecture boundariesSecurity Architecture

Exceptions and governance

Any identity or access exception requires documented approval, scoped compensating controls, and a target remediation date. Evidence requests: