Enterprise SSO & Access Control
EvidAI integrates seamlessly with enterprise identity providers, providing secure, centralized access management for organizations of any size.
Identity Provider Integration
Supported Protocols
| Protocol | Use Case | Status |
|---|
| SAML 2.0 | Enterprise SSO | ✅ Supported |
| OIDC/OAuth 2.0 | Modern apps, APIs | ✅ Supported |
| SCIM 2.0 | User provisioning | ✅ Supported |
| LDAP | Legacy directory | ✅ Via adapter |
Supported Identity Providers
| Provider | Integration Level |
|---|
| Okta | ✅ Native, certified |
| Azure AD / Entra ID | ✅ Native, certified |
| PingFederate | ✅ Native |
| OneLogin | ✅ Native |
| Google Workspace | ✅ Native |
| AWS IAM Identity Center | ✅ Native |
| Custom SAML/OIDC | ✅ Configurable |
Role-Based Access Control
Standard Roles
| Role | Permissions | Typical Users |
|---|
| Owner | Full platform administration | CIO, Department Head |
| Admin | User management, billing | IT Admin, Manager |
| Principal Investigator | Full review access, team management | Senior Researcher |
| Reviewer | Read/write on assigned reviews | Research Staff |
| Analyst | Analysis and reporting only | Statistician |
| Auditor | Read-only, audit trail access | QA, Compliance |
| Viewer | Read-only, limited scope | Stakeholders |
Custom Role Builder
Create roles tailored to your organization:
CUSTOM ROLE: "Junior Reviewer"
Base Template: Reviewer
Permissions Modified:
├── Protocol: View only (removed edit)
├── Screening: Execute + Review assigned studies only
├── Extraction: Execute on assigned studies
├── Quality Assessment: View only
├── Analysis: No access
├── Export: Request only (requires approval)
└── Team: View members only
Assignment Scope:
├── Projects: Assigned reviews only
├── Data: Own work + approved comparisons
└── Reports: Standard templates only
[Save Role] [Test Permissions] [Assign to Users]
Dual Review & Blinding
Blinded Review Configuration
For regulatory-grade systematic reviews requiring independent assessment:
| Feature | Configuration |
|---|
| Screening Blinding | Reviewers cannot see each other's decisions until complete |
| Extraction Blinding | Dual extraction without cross-visibility |
| RoB Blinding | Independent quality assessment |
| Unblinding Trigger | Automatic after both reviewers complete |
| Conflict Resolution | Third reviewer or PI arbitration |
Blinding Status Example
BLINDING STATUS: Review SLR-2024-001
Phase: Title/Abstract Screening
Reviewer 1: Dr. James Wilson
├── Progress: 847/1,234 (69%)
├── Can see: Own decisions only
└── Status: In progress
Reviewer 2: Dr. Maria Garcia
├── Progress: 1,234/1,234 (100%)
├── Can see: Own decisions only
└── Status: Complete, awaiting partner
Conflict Status:
├── Both complete: No
├── Conflicts detected: Pending unblinding
└── Resolution assigned: Dr. Sarah Chen (PI)
[Force Unblind - PI Only] [Send Reminder to Reviewer 1]
Multi-Factor Authentication
MFA Requirements
| User Type | MFA Requirement | Methods |
|---|
| Admin | Required always | TOTP, Hardware key, Push |
| Principal Investigator | Required always | TOTP, Hardware key, Push |
| Reviewer | Configurable | TOTP, Push, SMS* |
| Viewer | Configurable | TOTP, Push |
*SMS available but not recommended for sensitive data
Hardware Key Support
| Standard | Keys Supported |
|---|
| FIDO2 | YubiKey 5, Google Titan |
| WebAuthn | Platform authenticators |
| U2F | Legacy YubiKey |
Session Management
Session Controls
| Setting | Default | Configurable Range |
|---|
| Session Duration | 8 hours | 1-24 hours |
| Idle Timeout | 30 minutes | 5-120 minutes |
| Concurrent Sessions | 3 | 1-10 |
| Remember Device | 7 days | 1-30 days or disabled |
Session Security
ACTIVE SESSIONS: dr.smith@pharma.com
Session 1 (Current):
├── Device: MacBook Pro (Chrome 120)
├── Location: New York, NY
├── IP: 203.45.167.89
├── Started: Today, 9:15 AM
└── Last Activity: 2 minutes ago
Session 2:
├── Device: iPhone 15 (Safari Mobile)
├── Location: New York, NY
├── IP: 203.45.167.92
├── Started: Yesterday, 3:45 PM
└── Last Activity: 14 hours ago
[Revoke Session 2] [Revoke All Other Sessions]
Provisioning & Deprovisioning
Automatic User Lifecycle
| Event | Action | Timing |
|---|
| User added to IdP group | Account created in EvidAI | Real-time (SCIM) |
| Group membership change | Permissions updated | Real-time |
| User removed from IdP | Account deactivated | Real-time |
| Account disabled in IdP | Sessions terminated | Immediate |
Just-In-Time Provisioning
JIT PROVISIONING: Enabled
Mapping Configuration:
├── IdP Group: "EvidAI-Reviewers" → Role: Reviewer
├── IdP Group: "EvidAI-PIs" → Role: Principal Investigator
├── IdP Group: "EvidAI-Admins" → Role: Admin
├── Default Role (no group): Viewer
Attribute Mapping:
├── email → user.email
├── firstName → user.given_name
├── lastName → user.family_name
├── department → user.department
└── employeeId → user.external_id
Security Best Practices
Enterprise Deployment Checklist
| Item | Recommendation |
|---|
| SSO | Enable for all users; disable local passwords |
| MFA | Require for all roles; prefer hardware keys |
| Sessions | 8-hour max; 30-minute idle timeout |
| IP Restrictions | Whitelist corporate IPs for admin access |
| Audit Logging | Enable; configure SIEM integration |
| Data Residency | Select region matching compliance needs |
Enterprise Support: Our enterprise team provides white-glove SSO configuration. Contact support@EvidAI.ai for dedicated onboarding.
