Security

The portal is designed around restricted access, approved devices, audit logging, and least-privilege workspace permissions.

Access control

• Invitation-only enrollment
• Workspace-scoped permissions
• Authentication required for all workspace APIs

Device policy

• Unknown devices may be challenged or blocked
• Device sessions can be revoked by administrators
• Credentials and sync tokens are monitored for abuse indicators

Audit logging

Sign-ins, token events, API activity, sync operations, and administrative actions are logged for review.

Reporting vulnerabilities

Email security@entry-base.org. We aim to acknowledge legitimate reports within 48 hours.