Security & Trust: Protect Your Process Data

Why Security Comes First

When AI helps document core business workflows, security isn’t optional — it’s table stakes. Buyers expect clear answers on access control, auditability, data retention, and sharing with third parties.

Access Control: Who Sees What

• SSO (Okta, Azure AD, Google): centralize identity and enforce MFA/SSO policies.
• RBAC: per‑project and per‑diagram permissions (viewer, commenter, editor, owner).
• Least privilege: private by default; sharing requires explicit roles and expiry options.

Audit Trails and Retention

• Full audit history: who viewed, edited, commented, approved, and when.
• Versioned diagrams: restore prior states; approvals tied to immutable versions.
• Data retention: configurable policies per workspace; export on demand for reviews.

Sharing Safely With Vendors and Partners

• Link‑based access with role limits and expiry.
• Redaction options for sensitive notes; watermarks for exports if required.
• Clear ownership: see who shared, with whom, and for how long.

Data Residency and Protection

• Encryption in transit and at rest.
• Regional hosting options for residency requirements.
• Transparent subprocessors list and regular security reviews.

Buyer Questions — Straight Answers

• Where is data stored? Which region options exist?
• How are identities managed and provisioned/deprovisioned?
• What audit artifacts are available during compliance reviews?
• How is customer content used (or not) to train models?

Practical Tips for Teams

• Use groups from your IdP for RBAC at scale.
• Set retention defaults per workspace; override only when justified.
• Keep approvals in the tool (not email) to preserve auditability.
• Periodically review external shares and expire old links.

Security‑First Adoption

Involve security and compliance early. Share a short overview of access control, audit, and retention. Map controls to your frameworks (e.g., SOC 2, ISO 27001), and agree on an evaluation plan before pilot‑to‑rollout.

Evaluate Now

Invite your security lead to a brief walkthrough of SSO, RBAC, audit logs, and retention settings. Confirm that controls meet your standards before expanding adoption.

Where to Go Next

• Compliance Built‑In: Pass BPMN Reviews the First Time
• The Economics of AI‑Powered Process Modeling