Trust is built on specifics.
An identity provider holds the keys to everything else, so here’s what IdRa does, what has been tested, and what hasn’t.
How it’s built
- Isolation
- Each organization has its own Postgres database, and tenant-specific session and token secrets derived per tenant. Tenants are resolved from the request’s Host, never from a forwarded host header.
- Secrets at rest
- Tokens, keys and vault entries are encrypted with AES-256-GCM, under one deployment-wide key. Integration credentials are write-only, and vault reveals are logged. OIDC identity provider client secrets aren’t encrypted yet.
- Administrators
- Admins must use MFA to sign in, and sensitive actions need recent MFA. API tokens act without it. Administrators can’t be impersonated.
- Outbound requests
- Admin-supplied URLs go through an SSRF guard that requires https and checks that the address is public before connecting.
- Audit trail
- Admin changes write System Log events, with filters, CSV export and configurable retention.
- Browser defenses
- A Content Security Policy that blocks inline scripts, host-only cookies by default, and refusal of cross-origin cookie mutations.
What’s been tested
- A full-repository security audit in 2026, run with automated review agents. All 9 high-severity findings were fixed, along with nearly all medium ones. 19 low findings and 14 reports awaiting validation remain open
- OpenID Foundation conformance suite, Basic OP plan, self-run: 26 of 35 modules passed, 0 failed. Not a formal certification
- SAML sign-on with SimpleSAMLphp as the service provider
- Unit tests and browser end-to-end tests covering the main sign-in, admin and tenancy flows
What hasn’t been, yet
- No external security review or penetration test
- No SOC 2, ISO 27001, FedRAMP or similar certification
- Vendor integrations have run against fixtures and fakes, not every live service
- Single-replica deployment, with no key-management service or encryption-key rotation yet
- Geo signals on idra.team: country and ASN zones, new-country and impossible-travel detection need Cloudflare in front
- No published uptime commitment for the hosted service
On this website
This site sets no cookies and loads no analytics or third-party scripts. It stores one thing in your browser: your theme choice.
Running it yourself
Self-hosting gives you control of the database, the encryption key and the network. The self-hosting guide covers deployment and backups. Available once the repository is public.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.