Security & access
Your identity provider decides who does what
FTF keeps no users, groups or roles of its own. People sign in with their usual accounts, and FTF checks the permissions your identity provider gives them on every request.
Scoped to your environments and applications
A permission is an action, optionally narrowed to environments (by label) and applications. Grant by label and a new environment carrying it is covered with no change in your identity provider.
Separation of duties lives in the scopes: testers switch toggles only in their own environment; release managers promote between non-production environments; only operations promote into production.
Everyone signed in to your account can see its toggles and history. Permissions govern changes.
Secrets stay secret, keys stay narrow
Vendor credentials
Your LaunchDarkly or ConfigCat credential is encrypted with its own key, itself encrypted with a master key kept outside the database. It's never shown again — only its last four characters.
Client keys
One key per environment, revocable at any time. A key can be restricted to one application — the kind to use in a web page, where a key is public.
Signed webhooks
Changes from your vendor are accepted only when signed with the secret you set. ConfigCat's carry a timestamp, so an old one can't be replayed.
Evaluation context
The values your code passes with a call — a brand, an account, an amount — are used to answer it and not stored.
Your account, isolated
Each company's toggles, environments and keys belong to its own account. Toggle names carry your company's own prefix, unique to you.
A trail of every change
Every change to a toggle or release records who made it and when — in the dashboard, by a promotion, by an import, or by your vendor.
Microsoft Entra, Okta and others
Your company's FTF account is connected to your identity provider, so people sign in with their usual accounts. Either create one role or group per permission, or keep your own role names and we map them for you during set-up.
Questions about security?
Tell us what your security review needs and we'll answer it directly.