# Security considerations

## Data Privacy

groundcover’s architecture is built with privacy as one of its primary drivers. All data that groundcover collects is stored inside your environment. Our default deployment is built in a way that ensures no data ever leaves your cluster, and that remains the case forever. See our [Architecture](https://github.com/groundcover-com/docs/blob/main/architecture/security-considerations/broken-reference/README.md) section for more details.

When someone from your company enters the groundcover UI, a secure encrypted data tunnel will enable the movement of data to the UI, such that the user will be able to access and visualize the data. No data that is passed to the UI is persisted on groundcover's side. This architecture ensures that groundcover is, and remains, as privacy-focused as possible.

## Single Sign-On (SSO) Support with OIDC and SAML

{% hint style="info" %}
SSO support is an exclusive feature available in our [enterprise plan](https://www.groundcover.com/pricing). Implementing SSO requires coordinated actions between groundcover and your team. To initiate the process, please contact us through [Slack](https://www.groundcover.com/join-slack) to ensure seamless communication and successful setup.
{% endhint %}

groundcover offers robust support for Single Sign-On (SSO) through both OpenID Connect (OIDC) and Security Assertion Markup Language (SAML), to ensure seamless and secure access to our platform by integrating with your existing identity provider (IdP).

### OIDC

Built on the OAuth 2.0 framework, [OIDC](https://openid.net/developers/how-connect-works/) is a modern authentication protocol that uses JSON Web Tokens (JWTs) to transfer user information between parties. It is particularly well-suited for modern web applications, mobile apps, and APIs due to its lightweight, RESTful approach and ease of integration with JSON-based environments.

groundcover supports any IdP that uses OIDC, including:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-3d1f6a38ae47bfbf1eab6f40033c2c1ef6b4489c%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Okta</td><td><a href="security-considerations/okta-sso-onboarding">okta-sso-onboarding</a></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-ed97a699f4200af843bee24acf43e442dc9f8755%2Fimage.png?alt=media" alt="" data-size="line"></td><td>OneLogin</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-b744ce07ebd9dbe85ce112d57d089deb52e52016%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Auth0</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-affd23353dc0a79bf3f1aa8e6f469e9356d9da07%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Microsoft Azure AD (Active Directory)</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-49e25558eba49855d949a32e7ac1d451b1a0549f%2Fimage.png?alt=media" alt="" data-size="line"></td><td>PingIdentity</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-9acc3624b2d79f8403a723d359bfdb2dfb441d20%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Google Identity Platform</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-31c172e1d0ca6b276acaa4272cbd93c0db692c16%2FAmazon%20Cognito.png?alt=media" alt="" data-size="line"></td><td>Amazon Cognito</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-acd77cf0943505c6ad77ce4f8a9aefbbb71f551f%2Fimage.png?alt=media" alt="" data-size="line"></td><td>IBM Security Verify</td><td></td></tr></tbody></table>

### SAML

SAML is an older, XML-based protocol that was designed for enterprise-level security and is widely used for federating identity across disparate systems. SAML is ideal for single sign-on in legacy enterprise applications and environments where XML is already in use, providing robust support for complex organizational requirements and integrations.

groundcover supports any IdP that uses SAML, including:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-3d1f6a38ae47bfbf1eab6f40033c2c1ef6b4489c%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Okta</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-ed97a699f4200af843bee24acf43e442dc9f8755%2Fimage.png?alt=media" alt="" data-size="line"></td><td>OneLogin</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-824f0600f8cdaa85e1479869ea4f303ef6339e88%2Fimage.png?alt=media" alt="" data-size="line"></td><td>JumpCloud</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-49e25558eba49855d949a32e7ac1d451b1a0549f%2Fimage.png?alt=media" alt="" data-size="line"></td><td>PingIdentity</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-89da909a608fd1ca0ed1d8a6412ad594dd3fb2ab%2Fimage.png?alt=media" alt="" data-size="line"></td><td>CyberArk Identity</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-affd23353dc0a79bf3f1aa8e6f469e9356d9da07%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Microsoft Azure AD (Active Directory)</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-b744ce07ebd9dbe85ce112d57d089deb52e52016%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Auth0</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-4dc0f6c02fef6411d8180e0a983a4efb5f55c410%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Frontegg</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-c7c12fa14788475faac2090bfdf7d8fcd35ddb89%2Fimage.png?alt=media" alt="" data-size="line"></td><td>WorkOS</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-ac190211bbb2e14b2345422beea90c7ecdf85fd0%2Fimage.png?alt=media" alt="" data-size="line"></td><td>SecureAuth</td><td></td></tr></tbody></table>

{% hint style="info" %}
The full list of available SSO providers is too long to display. Any SSO provider that uses OIDC and/or SAML can be supported by groundcover. Full implementation guides for the most popular SSO providers for each protocol will be published soon.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.groundcover.com/architecture/security-considerations.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.