Know who can act
Apply tenant scope, role permissions, MFA, session policy, and module entitlement before sensitive work.
Security architecture
Know who can act, and how the action is controlled.
Review access, approvals, agent trust and data handling before putting a client workflow into Dayrook. Follow each control to the evidence available for your evaluation.
Proposed scope · concept illustration. Review evidence and availability.
Access, action, and evidence remain connected
Inspect the illustrative control architecture
Security architecture
Access, action, and evidence remain connectedControl architectureConceptual boundary
- Identity
Role, MFA, and customer scope
- Data
Regional boundary and protected records
- Action
Policy, approval, and stop conditions
- Evidence
Decision, result, and review trail
Before sensitive work
Identity, command trust and a reviewable record.
Trust the command path
Use enrolled identities, mTLS, signed commands, expiry, replay protection, and local agent policy.
Review what happened
Capture actor, scope, decision, approval, result, timestamp, and change context in audit records.
The authorization path
Check the request before it becomes an action.
- 01
Establish identity and scope
Resolve the user, tenant, customer, region, role, session, and requested action.
- 02
Enforce the policy gate
Check entitlement, billing state, MFA, approval, consent, secret access, and local policy.
- 03
Record the decision
Write allow, deny, failure, and material state changes to the evidence path.
Explore capabilities and controlsCapabilities · Connections · Controls for your technical review.
Control areas
Inspect the controls your workflow relies on.
Dayrook-owned identity
Email, Google, and Microsoft access with sessions, MFA, recovery, and enterprise SSO/SCIM readiness.
RBAC and scoped access
Built-in and custom roles govern module, customer, and action-level access.
Agent and collector trust
mTLS, certificate pinning, signed envelopes, nonces, expiry, and endpoint-side authorization.
Secret boundaries
Provider keys and sensitive credentials remain Digital Vault or KMS references rather than application-table values.
Regional data controls
US and EU workloads use region-aware databases, queues, workers, and object storage.
Audit and review
Material actions, denials, approvals, and results produce tenant- and region-bound evidence.
Across the boundary
Follow identity and device trust between systems.
Identity options
Dayrook Auth supports email and password, Google and Microsoft OAuth, MFA and recovery, with SAML/OIDC and SCIM for configured enterprise identity environments.
Machine-to-service trust
Agents and collectors use enrolled device identities, mTLS, certificate pinning, signed commands, nonces, expiry, replay protection, and endpoint-side authorization.
Review the exceptions
Check privileged access and data handling.
Dayrook keeps scope, access, approval, data placement, and audit evidence visible where the decision happens.
Review the security approachStep-up for sensitive work
Remote control, restores, Digital Vault access, infrastructure changes, and destructive actions can require fresh MFA and approval.
Privacy-aware observability
Analytics and error monitoring exclude secrets, payment data, ticket bodies, backup contents, and command output.
Questions, answered
Security architecture: common questions
Does Dayrook store payment card numbers?
No. Payment collection uses Stripe-hosted flows; Dayrook retains bounded billing references and audit metadata.
How are endpoint commands authorized?
The service checks user policy, then the agent independently verifies a signed, scoped, expiring command against local policy before execution.
Can data stay in the US or EU?
Customer and client records can be assigned to a supported US or EU data region, with related data-plane work routed to that region.
Is Dayrook certified?
Dayrook is designed around documented security and compliance-readiness controls. Certification claims require the applicable external audit, assessor, legal review, and approval.