Security

Two-Factor Authentication (2FA / MFA)

Asenion supports time-based one-time password (TOTP) two-factor authentication for all user accounts, compatible with any authenticator app (e.g. Google Authenticator, Authy, 1Password).

User-level 2FA

Any user can enable 2FA on their account from Personal Settings → Security → Two-Factor Authentication. The setup flow:

  1. Asenion generates a TOTP secret and displays a QR code.
  2. The user scans the QR code with their authenticator app.
  3. The user enters the one-time code to verify and activate 2FA.

Once enabled, the user must enter a TOTP code at each login.

Organization-level 2FA enforcement

Org Admins can require all members of their organization to have 2FA enabled. When enforcement is active:

  • Users who have not yet configured 2FA are blocked from accessing the platform after login.
  • A setup modal appears automatically, guiding them through the 2FA configuration before they can proceed.
  • Enforcement applies on every login session — the check is always fresh to account for admins enabling enforcement mid-session.

To enable org-wide 2FA enforcement, go to Organization Settings → Security → Enforce Two-Factor Authentication.

Single Sign-On (SSO)

Asenion supports SSO via Google OAuth and configurable enterprise identity providers. SSO configuration is available for Enterprise accounts.

Contact your account manager or support@asenion.ai to configure SSO for your organization.

Role-Based Access Control (RBAC) and Permissions

Access to every action in Asenion is governed by named capabilities assigned to roles, with per-user overrides on top. The two-layer structure:

  1. Platform roles — what a user can do across the organization (Org Admin, Compliance Manager, etc.)
  2. Project roles — what a user can do within a specific AI system (Owner, Reviewer, Approver, etc.)

Each role carries a default set of capabilities. Org Admins can grant or revoke individual capabilities per member without changing their role. The full capability list (27 built-in capabilities across platform, org, project, assessment, report, and test scopes) is documented in Permissions.

System Admins can view and edit the role-capability matrix and reset roles to platform defaults.

Data access

  • Users only see AI systems they own or have been explicitly added to.
  • Org Admins can access any record within their organization.
  • No cross-organization data access is possible for non-System Admin accounts.
  • A user’s capabilities are refreshed automatically every 2 minutes — revoked access takes effect without requiring a logout.