SSO with SAML & OIDC
Bring your identity provider; sign-in stays where your directory is.
Enterprise
Governance without the enterprise tax.
SSO, SCIM, path-level access control, audit, and key ownership — the controls a regulated org needs, on git storage you already own.
Identity
Your directory decides who signs in.
Connect SAML or OIDC, provision through SCIM, and deprovision the moment someone leaves.
SCIM provisioning
Users and groups sync from your IdP — joiners, movers, and leavers included.
Passkeys & TOTP
Phishing-resistant sign-in and one-time codes for every account.
Access control
Access rules that reach inside the repo.
Most forges stop at the repository boundary. GitForge scopes roles and visibility to refs and paths, so one shared repo can serve teams with different clearances.
Repository access
Path rulesacme/engine
Engine teamrw /
Design contractorsrw /assets/**
Support engineersr · release/* hidden
Rules evaluated on every read and write fail closed
Auditability
Every sensitive action, on the record.
Audit log
Sensitive actions recorded with actor, target, and timestamp.
IP allowlists
Restrict tenant access to the networks you approve.
Hashed tokens
Personal access tokens are stored as SHA-256 hashes, never plaintext.
Data ownership
Your bucket, your keys, your exit.
Data ownership here is architectural, not a contract clause: objects live in your storage, snapshots wrap under your KMS key, and revoking that key is a real off switch.
Your storage backend
Git objects live in the bucket you connect — residency follows your provider and region choice.
Customer-managed keys
Wrap tenant snapshots under your own KMS key, with on-demand rotation.
Crypto-shredding offboarding
Revoke your key and the wrapped data becomes unreadable — leaving is enforceable, not contractual.
Exit is a git clone
History already sits in your account; no export request, no migration project.
Posture
Built for review, not for slideware.
Multi-tenant with the workspace as an enforced security boundary, stateless servers, an audit trail on sensitive actions, and residency that follows your bucket choice. Ask us the hard questions — the architecture is the answer.
Keep exploring
Next step
Walk us through your requirements.
We'll map your identity, access, and residency needs onto GitForge — no deck, just answers.