Enterprise single sign-on
Sign in with your existing corporate credentials via Microsoft Entra ID. We never store or handle your password.
Security
Security controls and their evidence.
CloudPMO is a multi-tenant platform for professional delivery teams. It uses single sign-on through Microsoft Entra ID, tenant isolation in both the application and the database, role-based access control, encryption, and an append-only audit log for RAID changes.
How we protect your data
Six safeguards, working together
Each control below is bound to a claim with its evidence source.
Multi-tenant isolation
Tenant-scoped API routes resolve the caller's tenant from their membership and reject requests outside it. PostgreSQL row-level security adds a second check in the database.
Role-based access control
Six roles, each with a defined scope. Route guards and API endpoints enforce them together.
Encryption in transit and at rest
TLS between your browser, the application, and the database. Data is encrypted at rest on Azure managed infrastructure.
Immutable audit log
RAID changes are recorded with actor and timestamp. Entries cannot be edited or deleted via the API.
Concurrency protection
On versioned records, such as schedule tasks and demand requests, a second writer gets HTTP 409 instead of silently overwriting someone else's changes.
Identity & access
Your identity provider stays in control
Authentication is delegated to Microsoft Entra ID — CloudPMO never manages passwords. Access is decided by your organization's roles.
- Single sign-on with Microsoft Entra ID using your existing corporate credentials.
- Authorization Code flow with PKCE — no client secrets and no implicit flow for sign-in.
- v2.0 JWT tokens are validated on every signed-in API request: signature, audience, and issuer.
- Optional directory-backed people lookup via Microsoft Graph.
- A tenant's configured default role is assigned on first sign-in. The person who starts a trial becomes its first Tenant Admin; later role changes are made by an administrator.
| Role | What they can do |
|---|---|
| Tenant Admin | Full access including the Admin panel, tenant settings, and user management. |
| PMO Admin | Full portfolio access — manages demand review, scoring, and resources. |
| Project Manager | Full project management across scheduling, RAID, and reporting. No Admin panel. |
| Contributor | Updates assigned tasks and logs time. No project creation or admin access. |
| Executive | Monitors portfolio health and review status reports and exports. |
| Viewer | Read-only access to projects they are a member of; can submit project requests. |
Data protection
Your data stays yours
- Encrypted connections (TLS) between your browser, the application, and the database.
- Encryption at rest on Azure Database for PostgreSQL Flexible Server — backups and patching are handled by Azure.
- The application services run in Microsoft Azure's South Africa North region.
- Passwords are never stored or handled — identity is delegated to your identity provider.
- Tenant isolation has two layers: application checks on tenant-scoped routes, and PostgreSQL row-level security in the database. A small set of named system processes, such as sign-up and billing webhooks, use a separate database role limited to those entry points.
- No advertising or personalised tracking runs on the website; optional Google Analytics is consent-gated and limited to website page views and GA4's automatic session events.
- Authorized users can export schedule data to CSV at any time.
- Optional AI-assisted features use Anthropic, processed in the United States, under a written contract (POPIA section 72 transfer basis). Only project titles, WBS labels, task titles and RAID titles are sent; output is always a draft a person must review and confirm, and customer data is never used to train Anthropic's models.
Audit & accountability
Every RAID change leaves a record
- Every RAID item create, update, escalation, and close is recorded with the actor's name and timestamp.
- Setting severity to Critical automatically writes an escalation audit entry.
- Audit log entries are immutable — they cannot be edited or deleted through the API.
- Project staffing decisions are logged with the person, decision and role.
- Optimistic concurrency on versioned records prevents one person's edits from silently overwriting another's.