Security
Roles, single sign-on, an audit log and clear data rules
Every action in Cueston checks permissions, and every change is logged. The snippet stores only what you send it, for your workspace only.
Довіряють понад 200 SaaS-компаній, що зростають
What you get
Permissions, not role names
Five built-in roles and up to 50 custom roles. API keys, the CLI and AI agents act with their owner's current permissions.
Who did what, and when
The audit log records changes to content, publishing, members, roles, security settings, keys, webhooks and exports, plus every AI agent tool call.
No secrets in your page
The snippet's
pk_key can only read published guidance and send analytics. Secret keys stay on your server.
How it works
From an idea to live guidance, without waiting on a release.
Set up roles
Use Owner, Admin, Member, Contributor and Viewer, or create custom roles in Settings → Team & roles.
Lock down the snippet
Add allowed domains and turn on identity verification.
Connect your identity provider
Set up single sign-on over SAML or OpenID Connect, verify your domains, then add SCIM provisioning.
Set retention
Owners and admins choose how long events are kept in Settings → Data & privacy.
What's included
- Single sign-on
- SAML or OpenID Connect, with DNS-verified email domains, just-in-time provisioning and an option to require it. The owner keeps password access as a break-glass path.
- SCIM provisioning
- SCIM 2.0 with Okta, Microsoft Entra ID and others. Deactivating someone removes their membership, revokes their keys and ends their sessions. Groups map to roles.
- Audit log
- Filter by action, actor, target and date, and export up to 100,000 rows as CSV. Entries are kept for 400 days and never contain secrets.
- What the snippet records
- Guidance events, custom events you track and survey answers. It sets no cookies and does not record keystrokes, form values, mouse movement or the screen.
- Retention you control
- Guidance events are kept for 30 to 1,095 days (400 by default). A cleanup runs every night.
- End-user data requests
- Export or delete one person's data for a GDPR or CCPA request, from the dashboard or the API.
Questions
The app runs on Vercel and stores data in PostgreSQL at Supabase. Every row belongs to one workspace. Ask privacy@cueston.com for the hosting region and sub-processors.
See it on your own product
Get a short walkthrough of Cueston on your app, or start free and build your first one today.