Security. Facts, not adjectives.

Google-managed sign-in

Accounts are individual, invitation-only — there is no self-signup. Sign-in is handled by Google's identity service (Firebase Authentication) with email-enumeration protection and enumeration-safe password reset.

Revocation that actually revokes

Access is decided on every request, not at sign-in. Each authenticated call re-reads that person's membership from the database — nothing cached, no overnight job — so deactivating someone here, or letting a time-boxed grant lapse, takes effect on their very next request. Amberhold accounts that have been disabled or had their sessions revoked are rejected at the token layer as well.

Single sign-on

Microsoft Entra ID single sign-on is live. Your people sign in with their work account, and your Conditional Access and MFA policies apply unchanged. Disable somebody in your directory and they can no longer sign in to Amberhold. But signing in never grants access on its own — a membership on the site does — so an existing session is ended by deactivating that membership here, which takes effect on their very next request. Individual accounts remain available where a site prefers them.

Role-based, server-enforced, fail-closed

Operators, technicians, managers, site administrators and read-only auditor roles. Capabilities are checked on the server for every action; an unknown or expired identity gets nothing.

Time-boxed access

Guest access (an auditor, a contractor) can carry an end date. Past that instant the membership simply stops resolving — enforcement lives in the data, so there is no clean-up job to forget.

Append-only, enforced by the database itself

Evidence tables carry database-level triggers that reject UPDATE and DELETE. Corrections append; originals stay. This holds even against the application's own runtime credentials, which are granted no destructive rights on evidence.

Immutable audit trail

Administrative acts — invitations, role changes, publishes, clearances — are written to an append-only audit ledger in the same transaction as the change itself, so the act and its record cannot diverge.

Encryption

TLS for all traffic in transit; encryption at rest across all storage (Google Cloud default AES-256).

Network posture

The database is not internet-exposed — no public IP allow-lists; access is via Google's authenticated connector only. The application surfaces run behind strict Content-Security-Policy and security headers.

Least privilege throughout

Secrets live in Secret Manager. Runtime service accounts hold only the roles they need; the database runtime role cannot alter schema or touch evidence destructively; default broad IAM roles have been removed.