How rugged.sh reaches your customers' tenants
Access is app-only and scoped per customer tenant, with no standing administrator account. This page lists the mechanisms. If you need a security questionnaire answered before connecting a tenant, send it to [email protected].
Scoped app-only access, no standing admin
Onboarding a customer grants one app registration the Graph permissions it needs through admin consent, plus the Owner role on that customer's Azure subscription. We do not ask for Global Administrator and we do not hold customer user passwords. The consent is visible in the customer's own enterprise applications and can be revoked there.
Scope checked in the data-access layer
Every row and every operation carries a partner and customer-tenant scope, enforced in the store rather than in each screen, and covered by tests as a correctness invariant. A staff login can be restricted to a subset of customer tenants.
Secrets in Key Vault
Application credentials, signing keys and API tokens are read from Azure Key Vault through managed identity, not from application config or source control. One component acquires tokens; the rest of the codebase asks it rather than handling credentials directly.
Actions are recorded
Operator and MSP actions are written to an audit trail with the actor, the target and the time. A correlation id travels from the API call to the background job that executes it, so an action can be traced end to end. Audit rows are retained for a configurable window, one year by default.
Backups with point-in-time restore
Postgres runs automated backups with point-in-time restore across a rolling 35-day window, plus weekly full backups held three months in a geo-redundant vault. The restore path has been exercised end to end on a throwaway server with row counts compared against live. Ask for the date of the most recent restore test and we will give it to you.
Support, and what we do not promise
Platform support is an always-on ticket channel inside the console. We reply usually within one business day, Atlantic time. There is no contractual SLA, no overnight rota and no status page yet; we would rather say that than let you infer one. We are a small team and you will be talking to the people who wrote the code.
MFA and email verification
Self-serve signup requires email verification and a second factor, TOTP or an emailed code, before the console is reachable. Sessions use secure cookies over HSTS, and mutating requests are rejected when the origin is neither the app's own host nor a configured allowlist entry.
Questions before you connect a customer?
Email [email protected] or open a ticket and a real person answers.