Signing in to BoundaryLogic Trace
Authentication is handled by external identity providers, using Microsoft identity accounts and Firebase Authentication. Authentication follows standard identity federation practices.
BoundaryLogic does not store user passwords. Authentication credentials are managed by the identity provider.
Sessions use token-based authentication. Token expiration and refresh are governed by the identity provider, and all authentication traffic is encrypted.
Internal access to systems
Access to internal systems and infrastructure is granted based on operational role. Administrative access to production infrastructure is limited to authorised personnel responsible for system maintenance and deployment. Access privileges are reviewed periodically and adjusted when responsibilities change.
Multi-factor authentication is required for all employee accounts.
Source code
All application source code is held in private repositories. Access is restricted to authorised engineering personnel. Changes to production code require a pull request, code review and approval before merging, and direct commits to production branches are restricted.
When someone leaves
When an employee or contractor leaves or no longer requires access, account access is revoked promptly. Because internal systems authenticate through a single identity provider, disabling that account removes access across systems.