> For the complete documentation index, see [llms.txt](https://docs.groundcover.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.groundcover.com/operate/security-considerations.md).

# Security considerations

## Data Privacy

groundcover’s architecture is built with privacy as one of its primary drivers. All data that groundcover collects is stored inside your environment. Our default deployment is built in a way that ensures no data ever leaves your cluster, and that remains the case forever. See our [Architecture](https://github.com/groundcover-com/docs/tree/main/architecture/security-considerations/broken-reference/README.md) section for more details.

When someone from your company enters the groundcover UI, a secure encrypted data tunnel will enable the movement of data to the UI, such that the user will be able to access and visualize the data. No data that is passed to the UI is persisted on groundcover's side. This architecture ensures that groundcover is, and remains, as privacy-focused as possible.

## Single Sign-On (SSO) Support with OIDC and SAML

{% hint style="info" %}
SSO support is available in our Pro and Enterprise plans. Implementing SSO requires coordinated actions between groundcover and your team. To initiate the process, please contact us through [Slack](https://www.groundcover.com/join-slack) to ensure seamless communication and successful setup.
{% endhint %}

groundcover offers robust support for Single Sign-On (SSO) through both OpenID Connect (OIDC) and Security Assertion Markup Language (SAML), to ensure seamless and secure access to our platform by integrating with your existing identity provider (IdP).

### OIDC

Built on the OAuth 2.0 framework, [OIDC](https://openid.net/developers/how-connect-works/) is a modern authentication protocol that uses JSON Web Tokens (JWTs) to transfer user information between parties. It is particularly well-suited for modern web applications, mobile apps, and APIs due to its lightweight, RESTful approach and ease of integration with JSON-based environments.

groundcover supports any IdP that uses OIDC, including:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-3d1f6a38ae47bfbf1eab6f40033c2c1ef6b4489c%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Okta</td><td><a href="/administer/okta-sso-onboarding.md">Okta SSO</a></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-ed97a699f4200af843bee24acf43e442dc9f8755%2Fimage.png?alt=media" alt="" data-size="line"></td><td>OneLogin</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-b744ce07ebd9dbe85ce112d57d089deb52e52016%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Auth0</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-affd23353dc0a79bf3f1aa8e6f469e9356d9da07%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Microsoft Azure AD (Active Directory)</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-49e25558eba49855d949a32e7ac1d451b1a0549f%2Fimage.png?alt=media" alt="" data-size="line"></td><td>PingIdentity</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-9acc3624b2d79f8403a723d359bfdb2dfb441d20%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Google Identity Platform</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-31c172e1d0ca6b276acaa4272cbd93c0db692c16%2FAmazon%20Cognito.png?alt=media" alt="" data-size="line"></td><td>Amazon Cognito</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-acd77cf0943505c6ad77ce4f8a9aefbbb71f551f%2Fimage.png?alt=media" alt="" data-size="line"></td><td>IBM Security Verify</td><td></td></tr></tbody></table>

### SAML

SAML is an older, XML-based protocol that was designed for enterprise-level security and is widely used for federating identity across disparate systems. SAML is ideal for single sign-on in legacy enterprise applications and environments where XML is already in use, providing robust support for complex organizational requirements and integrations.

groundcover supports any IdP that uses SAML, including:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-3d1f6a38ae47bfbf1eab6f40033c2c1ef6b4489c%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Okta</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-ed97a699f4200af843bee24acf43e442dc9f8755%2Fimage.png?alt=media" alt="" data-size="line"></td><td>OneLogin</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-824f0600f8cdaa85e1479869ea4f303ef6339e88%2Fimage.png?alt=media" alt="" data-size="line"></td><td>JumpCloud</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-49e25558eba49855d949a32e7ac1d451b1a0549f%2Fimage.png?alt=media" alt="" data-size="line"></td><td>PingIdentity</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-89da909a608fd1ca0ed1d8a6412ad594dd3fb2ab%2Fimage.png?alt=media" alt="" data-size="line"></td><td>CyberArk Identity</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-affd23353dc0a79bf3f1aa8e6f469e9356d9da07%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Microsoft Azure AD (Active Directory)</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-b744ce07ebd9dbe85ce112d57d089deb52e52016%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Auth0</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-4dc0f6c02fef6411d8180e0a983a4efb5f55c410%2Fimage.png?alt=media" alt="" data-size="line"></td><td>Frontegg</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-c7c12fa14788475faac2090bfdf7d8fcd35ddb89%2Fimage.png?alt=media" alt="" data-size="line"></td><td>WorkOS</td><td></td></tr><tr><td><img src="https://2771001740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUHgqKYgCiRKdOpWQdi52%2Fuploads%2Fgit-blob-ac190211bbb2e14b2345422beea90c7ecdf85fd0%2Fimage.png?alt=media" alt="" data-size="line"></td><td>SecureAuth</td><td></td></tr></tbody></table>

{% hint style="info" %}
The full list of available SSO providers is too long to display. Any SSO provider that uses OIDC and/or SAML can be supported by groundcover. Full implementation guides for the most popular SSO providers for each protocol will be published soon.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.groundcover.com/operate/security-considerations.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.