Forward Deployed Engineering Tutorial · Deploying in Customer Environments · Lesson 15 of 24

Security Reviews, SSO and Compliance

Get through enterprise security reviews: questionnaires, SOC 2 and ISO 27001, SSO with SAML or OIDC, SCIM provisioning and data processing terms.

Create a free account to save this page, take notes and track your progress. Sign in

What enterprises ask for

Security questionnaires (often hundreds of questions) and evidence: SOC 2 Type II report, ISO 27001 certificate, penetration test summary.
Data handling: where data is stored (region), encryption, retention and deletion, sub-processors, and a data processing agreement.
Identity: SSO with their identity provider (Entra ID, Okta, Google) via SAML 2.0 or OIDC, and user provisioning/deprovisioning with SCIM.
Access controls: role-based access, audit logs they can export.

SSO in one minute

The user signs in at their company's identity provider, which sends your app a signed assertion (SAML) or ID token (OIDC). You verify the signature, the audience, and the time window, then map groups to roles.

Validating an SSO assertion, with clock skewTry it yourself

def validate_assertion(a, now, audience="https://app.example.com", skew=120):
    checks = {
        "signature valid": a["signature_ok"],
        "audience matches": a["audience"] == audience,
        "not before": now >= a["not_before"] - skew,
        "not expired": now < a["not_on_or_after"] + skew,
    }
    failed = [k for k, ok in checks.items() if not ok]
    return "accepted" if not failed else f"rejected: {', '.join(failed)}"

assertion = {"signature_ok": True, "audience": "https://app.example.com", "not_before": 1000, "not_on_or_after": 1300}
print("clocks in sync:      ", validate_assertion(assertion, now=1005))
print("our clock 90 s ahead: ", validate_assertion(assertion, now=910))
print("our clock 5 min ahead:", validate_assertion(assertion, now=700))

Output

clocks in sync:       accepted
our clock 90 s ahead:  accepted
our clock 5 min ahead: rejected: not before

Tips for FDEs

Keep a ready-made security package; involve your security team early; answer precisely and honestly ("no, but here's the mitigation"); and track the review as a critical-path milestone.

Test yourself

Which standard automatically creates and removes user accounts when people join or leave the customer's company?

SAML
SCIM
OAuth implicit flow
LDAP over HTTP

Show answer

Answer: SCIM

SAML/OIDC handle sign-in; SCIM handles provisioning and deprovisioning.

Was this page helpful?