Akantik IAM handles identity and access data for connected systems like Google Workspace, Microsoft 365, Slack, GitHub, and more, so we take the security of that data seriously. Below is what's actually implemented today — not aspirational language.
Encryption in transit
All traffic to Akantik IAM is served over HTTPS, with HTTP requests automatically redirected and HSTS enabled.
Encrypted OAuth tokens
Access and refresh tokens for connected third-party applications (Google Workspace, Microsoft 365, Slack, GitHub, Bitbucket, Jira, and others) are encrypted at rest, not stored as plain text.
Hashed and salted passwords
Account passwords are never stored in plain text — each password is salted and hashed before it's saved.
Role-based access control
Access within the Akantik IAM console itself is scoped by role (Super Admin, Admin, and read-only roles), enforced on every request at the application layer.
Tenant data isolation
Every tenant-scoped query is filtered to the current tenant at the data-access layer. A request with no valid tenant context returns no data, rather than falling back to a broader view.
Audit logging
Access and provisioning changes are recorded to an audit log. The application exposes no way to edit or delete existing audit log entries through its normal interfaces.
What we don't have yet
In the interest of not overstating our posture: Akantik IAM does not currently hold a SOC 2 or ISO 27001 certification, and multi-factor authentication for the Akantik IAM console itself is not yet available. If either of these is a requirement for your organization, contact us — we're happy to discuss timelines.