{
  "updatedAt": "2026-08-18",
  "summary": "Recommended hardening settings for organizations deploying Trust Swiftly for Government. These recommendations complement the platform's secure defaults; apply them during initial tenant configuration and re-verify them at your periodic access reviews.",
  "note": "Settings are configured by your tenant administrators in the admin console unless noted. For configuration assistance, contact the Security contact listed on this trust center.",
  "sections": [
    {
      "title": "Administrative identity and access",
      "items": [
        {
          "recommendation": "Connect single sign-on (SSO) to your identity provider and enforce it for every administrative user.",
          "detail": "Centralizing sign-in at your IdP applies your organization's lockout, session, and conditional-access policies to platform access, and lets you revoke access in one place."
        },
        {
          "recommendation": "Enforce multi-factor authentication for all users, with no exempted accounts.",
          "detail": "Enforce MFA at the tenant level so newly provisioned operators inherit the requirement automatically."
        },
        {
          "recommendation": "Prefer phishing-resistant passkeys; for federal deployments use FIPS 140-validated hardware authenticators such as the YubiKey FIPS series.",
          "detail": "Hardware-bound passkeys resist phishing and credential replay, consistent with federal zero-trust guidance on phishing-resistant MFA."
        },
        {
          "recommendation": "Enable SCIM provisioning from your identity provider.",
          "detail": "Joiner, mover, and leaver events in your directory then create, update, and deprovision platform accounts automatically — separated staff lose access without a manual step."
        },
        {
          "recommendation": "Assign least-privilege roles scoped to job function.",
          "detail": "Restrict each role to what the job requires — for example, reviewers who work the verification queue do not need settings or billing administration. Keep the administrator role to the minimum set of operators and review assignments quarterly."
        },
        {
          "recommendation": "Restrict administrative access to corporate egress IPs with an IP allowlist.",
          "detail": "An allowlist confines admin sessions to your managed network paths (VPN or corporate egress), so stolen credentials alone are not sufficient from an arbitrary network."
        },
        {
          "recommendation": "Limit platform access to staff who need it, and remove dormant accounts.",
          "detail": "Disable accounts unused beyond your dormancy threshold and remove access immediately at separation — SCIM automates the latter."
        }
      ]
    },
    {
      "title": "API and integration security",
      "items": [
        {
          "recommendation": "Issue limited-permission API tokens scoped to what each integration needs.",
          "detail": "Create one token per integration with the fewest abilities that work; never share a token across systems, and never embed tokens in client-side code."
        },
        {
          "recommendation": "Rotate API tokens periodically, and immediately on staff changes or suspected exposure.",
          "detail": "Scheduled rotation bounds the life of any token that leaks outside your control."
        },
        {
          "recommendation": "Deliver webhooks only to HTTPS endpoints you control, and authenticate each payload at your receiver before acting on it.",
          "detail": "Validate that inbound events genuinely originate from the platform before your systems act on verification outcomes."
        },
        {
          "recommendation": "Keep test and production configurations separate, and never send real personal data through test workflows.",
          "detail": "Separate tenants or clearly separated workflows prevent test integrations from touching production identity evidence."
        }
      ]
    },
    {
      "title": "Data minimization and retention",
      "items": [
        {
          "recommendation": "Set the shortest data retention window your records schedule allows — configurable from 1 to 120 days.",
          "detail": "Verification evidence is deleted when the window expires; a shorter window means less personal data at rest at any moment."
        },
        {
          "recommendation": "Enable only the verification methods your risk level requires.",
          "detail": "Tailor workflows per risk level and collect the minimum evidence that satisfies the assurance requirement — reserve higher-assurance methods for the populations that need them."
        },
        {
          "recommendation": "Apply legal hold narrowly, and remove it when the matter closes.",
          "detail": "A hold suspends deletion for the named user only; a hold left in place after the matter ends becomes unmanaged retention."
        }
      ]
    },
    {
      "title": "Monitoring, alerting, and audit",
      "items": [
        {
          "recommendation": "Enable SIEM export and logging into your security tooling.",
          "detail": "Streaming platform events to your SIEM puts verification activity in the same detection and retention pipeline as the rest of your estate."
        },
        {
          "recommendation": "Enable country restriction alerts routed to your security team.",
          "detail": "Access or verification activity from unexpected geographies is surfaced to your team for review."
        },
        {
          "recommendation": "Enable device velocity rules.",
          "detail": "Velocity rules flag the same device appearing across many identities in a short window — a common pattern in organized fraud."
        },
        {
          "recommendation": "Treat fraud and risk signals as review telemetry, not automatic blocks.",
          "detail": "Route signals to your review workflow so a trained reviewer decides the outcome; silent auto-blocking hides fraud patterns from your team and penalizes false positives."
        },
        {
          "recommendation": "Review administrative audit logs periodically.",
          "detail": "Include role and permission changes, settings changes, and data exports in your periodic access review."
        }
      ]
    }
  ]
}