Security & SSO

PurpletGo provides enterprise-grade security controls including SAML SSO, multi-factor authentication, IP allowlisting, and SIEM integration.

SAML Single Sign-On

PurpletGo supports SAML 2.0 SSO, available on the Enterprise plan. It works with any SAML 2.0-compliant identity provider - Okta, Azure AD / Microsoft Entra, Google Workspace, and others that speak the standard.

Setting up SAML SSO

1. Go to Settings → Security → SAML SSO (Admin or Super Admin role required).
2. Copy the ACS URL, SP Entity ID, and SLO URL shown there - your IdP will ask for these.
3. In PurpletGo, provide your IdP's metadata: either paste its metadata XML, give PurpletGo an HTTPS URL to fetch it from, or enter the IdP entity ID, SSO URL, and certificate manually.
4. Choose whether new users should be created automatically the first time they sign in via SSO (JIT provisioning), and what role they get by default. You can also map SAML group membership to specific PurpletGo roles.
5. Save, then use Test Connection to confirm PurpletGo can reach your metadata URL.

Once a user signs in via SSO for the first time (with JIT enabled), PurpletGo either links them to an existing account with the same email or creates a new one - it never asks that user to set a password, since they'll always come in through the IdP.

Two-Factor Authentication (2FA)

Any PurpletGo user can turn on TOTP-based 2FA for their own account:

1. Go to your Profile → Security and click Enable 2FA.
2. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.), or enter the secret manually.
3. Enter the 6-digit code it generates to confirm and activate 2FA.

Once enabled, a valid code is required on every login, on top of your password. Disabling 2FA requires both your current password and a valid code from your authenticator - there are no backup/recovery codes, and there's no admin override to force-disable 2FA on someone else's account, so keep your authenticator app backed up.

IP allowlisting and geo-blocking

Under Settings → Security → Access Controls, an Admin or Super Admin can restrict access by network:

• IP allowlist - a list of IPs or CIDR ranges (up to 100 entries). Once set, any request from an address outside the list is rejected with a 403.
• Blocked countries - a list of ISO country codes (up to 50) to deny outright, based on the request's geolocated country.

Session management

• Sessions are valid for 7 days from login by default, based on the age of the session token - not idle time.
• An org can additionally set a session timeout (1-8,760 hours) that caps how long any session stays valid regardless of the 7-day default, and terminate every active session org-wide from Settings → Security (a rate-limited "panic button" for Admins and Super Admins).
• Each user can view and revoke their own active sessions from Profile → Security → Active Sessions, including "sign out everywhere else."
• Session tokens are stored in HttpOnly cookies, not accessible to JavaScript.

SIEM export

Enterprise customers can stream security events to Splunk, Datadog, Elasticsearch, Sumo Logic, New Relic, or a generic HTTP endpoint. See SIEM Integration for setup and the full list of events forwarded.

How sensitive data is protected

• Passwords are hashed with bcrypt - never stored or logged in plain text.
• TOTP (2FA) secrets are encrypted at rest with AES-256-GCM.
• API keys are stored as a SHA-256 hash of the raw key; the raw value is shown once, at creation, and never again.
• Audit log entries are chained with HMAC-SHA256, so any attempt to alter or delete a past entry breaks the chain and is detectable.

Responsible disclosure

Found a security vulnerability? Please report it to security@purpletgo.com. We aim to acknowledge reports within 24 hours and resolve critical issues within 72 hours.