Six mechanisms, not one adjective

Every customer gets its own realm in Keycloak, an open-source identity server. All API traffic is authenticated with short-lived, signed JSON Web Tokens issued through the standard OAuth2/OIDC flow. The gateway validates every request's token signature against the issuing tenant's realm before the request reaches any business logic, and it keeps no session or cookie state of its own: the backend is a stateless OAuth2 resource server, so there is nothing sitting in server memory for an attacker to hijack between requests.

Your staff do not need a second password. SkyRoster federates login against the identity provider you already run:

• Microsoft Entra ID (Azure AD), through Keycloak's built-in Microsoft OIDC identity provider. An optional "autologin" mode skips SkyRoster's own login screen entirely and redirects straight to your Microsoft sign-in, while administrative accounts can be kept on a standard username-and-password screen for break-glass access if your identity provider is ever unreachable.
• On-premises Active Directory, through Keycloak's LDAP federation, with optional Kerberos for a fully passwordless login from inside your own network. A separate, one-directional sync job can also read your Active Directory to create matching employee records automatically as people join, though it does not remove someone from SkyRoster when they leave your directory; that step stays with whoever administers your organisation here.

A single access-control decision is enforced three times, independently, rather than once at the door:

1. At the endpoint. Before a controller method runs at all, it checks whether the calling user holds the membership tier the action requires.
2. At the command or query itself. The same check runs again inside the handler that actually does the work, which matters because not every internal call arrives through an HTTP endpoint; a handler invoked from a background job or another service is checked exactly the same way a browser request would be.
3. At the database. See below: the query is scoped to what the caller may see before it runs, not filtered afterward.

The full model behind what "the membership tier the action requires" means, the sixteen areas it applies to and how read and write are scoped independently, is on the access control page.

A wildcard certificate is installed independently in every namespace that serves traffic over HTTPS, so transport is encrypted for the application itself and for the operational tooling around it alike. The gateway enforces an explicit allow-list of origins per environment and restricts request headers to exactly the ones the application needs. It is also, by construction, the only externally reachable service: every one of the platform's backend services sits behind it, not beside it.

SkyRoster has undergone third-party security testing. Every finding from that testing has been remediated, and each remediation shipped with its own automated test that fails the build if the same gap ever reopens. We describe this generically and do not publish the specific findings or internal ticket references; the point that matters to a reviewer is that hardening is tested and regression-checked, not that a list of past weaknesses is public.