Security at PeopleParity
Single sign-on with Microsoft, permissions enforced on the server down to the record, audit logs for AI access, and a deployment and database of your own.
Single sign-on with Microsoft
Staff sign in with the Microsoft account they already have. Your IT team completes the setup without waiting on us.
- Microsoft Entra ID single sign-on over SAML 2.0
- Service-provider metadata endpoint for self-service configuration
- Microsoft sign-in on mobile using PKCE
- Restrict sign-up and sign-in to your own email domains
- Access revoked automatically when an employee is marked as exited
Permissions down to the record
Access is defined per application, per resource and per action — then narrowed by how much data each role can see.
- Five data scopes: everything, team, assigned, own, or none
- Team scope resolves shared teams and direct reporting lines
- Build your own roles with a visual permission matrix
- Domain-specific actions beyond create and edit, such as approve, revoke and retire
- Enforced on the server, not just hidden in the interface
Works with AI assistants
Connect Claude or any Model Context Protocol client and let it read your business data — strictly within each user's own permissions.
- Model Context Protocol server with around 68 tools
- Per-user access keys, issued and revoked from the app
- Every request runs through the same permission checks as the interface, so a key can never exceed its owner
- Rate limited, with an append-only audit log of every call
- Compatible with Claude Desktop, Claude Code and other MCP clients
Your name on it
Set the application name, logo and accent colour so the suite reads as an internal system.
- Custom application name
- Your logo, applied across the suite
- Accent colour used through the interface
- Each customer runs on their own deployment with their own database
FAQ
Security questions
How do people sign in to PeopleParity?
With Microsoft Entra ID single sign-on over SAML 2.0, using the Microsoft account they already have. You can restrict sign-up and sign-in to your own email domains, and access is revoked automatically when an employee is marked as exited.
How is access to data controlled?
Access is defined per application, per resource and per action, then narrowed by a data scope: everything, team, assigned, own or none. Permissions are enforced on the server, not just hidden in the interface.
Can AI assistants read our data?
Only if you connect one, and only within each user’s own permissions. Per-user access keys are issued and revoked from the app, requests are rate limited, and every call is written to an append-only audit log.
Is our data kept separate from other customers?
Yes. Each customer runs on their own deployment with their own database.