Organisation identity
People authenticate through the organisation’s identity provider over OpenID Connect. Human, machine and external-recipient principals stay distinct in the product.
Security architecture
Protect the object: identity, keys, tenancy and the trail it leaves.
Casewelt encrypts each file version, isolates organisations in the data layer, signs people in through their identity provider and records the decisions that follow. The same model covers staff work, external shares and machine automation.
Envelope encryption
Each content version has its own data key, wrapped by the organisation key. Customer-managed keys are available where the organisation needs to hold that wrapping key.
Tenant isolation
Every request runs in an organisation context. Database access is constrained per tenant, so one organisation’s objects are not visible to another.
Sessions, devices and events
Casewelt keeps an explicit revoke state so a session can be ended directly without waiting for the access token to expire.
Access tokens are short-lived. Session revoke takes effect in the product. Machine identities use their own enrolled credentials and device certificates, and speak mTLS.
Audit is append-only. Webhooks are signed, replay-protected and retried. Administrators can list deliveries and replay an event when a downstream system missed it.
Explore the security modelInspect architecture
Walk through the controls with your security team.
Bring the identity provider, key-management preference and audit destinations you already run. We’ll centre the demo on those integrations.