Every layer of the LabsNinja SCIM Connector is designed with security as a first principle — from credential storage to tenant isolation.
SCIM bearer tokens are hashed with bcrypt before storage. Plaintext credentials are never persisted to disk or logs.
Credentials can be rotated at any time via the operator dashboard. Old tokens are invalidated immediately on rotation.
Operator and customer sessions use signed session tokens with configurable expiry and revocation support.
The application validates all required environment variables at startup and refuses to start if any are missing.
SCIM credentials are tenant-scoped. A token issued for tenant A cannot access or modify tenant B data.
Internal operator routes and customer-facing routes are on separate auth stacks with different session types and privilege levels.
Contact us for security documentation, compliance questionnaires, or to report a vulnerability.
Security Inquiry