Skip to content
Enclessa
Get started

Glossary · Operations

SCIM

All termsHow Enclessa secures data

SCIM is an open standard, published as RFC 7643 and RFC 7644, that lets an identity provider create, update and deactivate user accounts in another application automatically over a REST API.

Open betaThe platform is being built in the open, so parts of it are not there yet, behaviour changes between releases, and no availability figure is committed while it is in beta. What is still being built.

Also called

System for Cross-domain Identity Management

What SCIM means

SCIM answers the half of identity management that single sign-on leaves open. Single sign-on decides whether somebody can get in; SCIM decides whether an account exists at all and what attributes it carries. Without it, a joiner has to be added by hand in every application and — the part that matters — a leaver has to be removed by hand in every application.

The deprovisioning case is the reason SCIM appears in security questionnaires. Manual removal across a dozen systems is reliably incomplete, and the accounts that survive a departure are the ones that turn up later in an incident report. Automatic deactivation from the identity provider closes that gap by making the directory the single place a departure is recorded.

SCIM is also frequently used to synchronise group membership, so that a directory group becomes an application group and access follows the organisational structure rather than a copy of it maintained separately.

How Enclessa uses it

Enclessa does not support SCIM. Members are invited and removed within the organisation, and there is no directory synchronisation. SCIM is planned enterprise work in phase 5, alongside single sign-on, and until it ships an organisation that requires automated provisioning should treat its absence as decisive.

Where SCIM is specified

Related terms

Single sign-on (SSO)Single sign-on is an arrangement in which one identity provider authenticates a person once and then vouches for them to other applications, so that each application never handles their password.Read the entryTenant isolationTenant isolation is the guarantee that no request made by one customer organisation can read or change any data belonging to another, enforced by the system rather than by convention.Read the entryAudit logAn audit log is an append-only record of who did what, to which object, and when — kept separately from application logs so that it can be relied on as evidence rather than read as debugging output.Read the entry

Read further

The security page explains how Enclessa protects data and which certifications it does not hold. The trust centre covers the processing agreement, the subprocessors and the residency position. The FAQ answers the questions buyers ask most often.

Encrypted collaboration, hosted in Europe.

Create a workspace in a couple of minutes. It is yours at your-team.enclessa.app, hosted in the European Union, with encrypted direct messages from the first one you send.

Create your workspaceSee pricing

Open beta. Free plan, no payment card to start.