Skip to main content
SupaCortex
Sign in Book a Demo
Feature

Decide who can teach it, and who can only ask

Your knowledge is what the assistant says to customers. SupaCortex keeps changing it to the people you choose, with Google or Microsoft sign-in and a second step that cannot be skipped.

Book a demo See pricing
  • Four roles
  • Google and Microsoft SSO
  • Authenticator codes

How does access control work in SupaCortex?

Every person in a SupaCortex workspace has one of four roles - Viewer, Editor, Admin or Owner - and each role includes the one below it. People sign in with a password, or with Google or Microsoft for users who already exist in the workspace, and an organisation can switch to SSO only. Anyone can add two-step verification with an authenticator app, which is asked for even after SSO. Role changes and deactivations apply to open sessions within a minute.

  • Roles: Viewer < Editor < Admin < Owner. Only an Owner can create or change an Owner.
  • The last active Owner cannot be demoted or deactivated.
  • Google and Microsoft sign-in for existing users; optional SSO-only mode.
  • Authenticator-app codes (TOTP) with ten single-use recovery codes.
  • Repeated failed sign-ins are throttled; five wrong codes lock the second step for 15 minutes.
  • Each workspace has its own sub-domain and its own databases.
Roles at a glance

Each role includes the one below it

Give most people Viewer. Editors keep the knowledge current; Admins run the workspace.

What they can do Viewer Editor Admin Owner
Team chat, the playground, reading projects, documents and drafts
Uploading, reindexing and deleting documents; running feeds
Reviewing and approving Q&A mined from past tickets
Projects, the chat widget, API connectors, cloud-drive connections
Users, API keys, conversation logs, insights and AI credits
Creating or changing an Owner; invoices
In detail

Sign-in that holds up

Google and Microsoft sign-in

Most teams already have a company Google or Microsoft account. They should not need another password.

  • "Continue with Google" or "Continue with Microsoft" on your workspace's sign-in page.
  • Only people who already have an active user in your workspace get in - no accounts appear on their own.
  • Deep links survive the round trip, so a shared link opens the right page after sign-in.
  • SSO-only mode hides the password form and refuses password sign-ins.

A second step people cannot skip

Two-step verification is checked at sign-in - with a password or with SSO.

  • Any authenticator app: Google Authenticator, Microsoft Authenticator, 1Password and the like.
  • The QR code is drawn on our own server; the secret never goes to a third-party QR service.
  • Each code works once; five wrong codes lock the second step for fifteen minutes.
  • Ten recovery codes, shown once; regenerating them retires the old set.
  • Turning it off needs a current code, so a stolen session cannot remove it.

Changes that take effect now

When someone leaves or changes job, their access should change with them - not at the next sign-in.

  • Every request re-checks that the user is still active and still has the role in their token.
  • Deactivate a user, or lower their role, and it applies within a minute.
  • Only an Owner can create, promote, change or reset another Owner.
  • The last active Owner cannot be removed, so a workspace is never left without one.

Access is by role and by project. SupaCortex does not copy file-level sharing from Drive or SharePoint - you choose what each project contains and who can ask it.

Related

Security

Separate databases per workspace, encrypted secrets, and answers scoped to who is asking.

Knowledge Projects

Keep each product, team or audience in its own project - its own sources, widget and API keys.

Search & Answer API

The same brain behind your own tools: scoped API keys, /v1/search and /v1/answer.

Team Chat Over All Knowledge

Your team asks across every project at once, with a private history and sources on every answer.

Banking & Financial Services

Answers that cite the approved product document, and say so when there is none.

Pricing

Four plans with monthly AI credits. Website visitors and app users never count as seats.
Frequently asked

Questions people ask before they start

Viewers use team chat, browse projects and documents and try questions in the playground. Editors also upload, reindex and delete documents, run feeds and review Q&A mined from past tickets. Admins manage projects, the chat widget, connectors, users, API keys and conversation logs. Owners can also manage other Owners and see invoices. Each role includes everything below it.

Yes. "Continue with Google" and "Continue with Microsoft" sit on your workspace's sign-in page. SSO signs in people who already have a user in your workspace - an unknown address is refused, never given an account automatically.

Yes. An Admin or Owner can make the organisation SSO-only under Settings, Security. The password form then disappears from the sign-in page and password sign-ins are refused. SupaCortex asks you to confirm first, so nobody locks themselves out.

Yes. A user who has turned on authenticator codes is asked for one after Google or Microsoft too. Their choice is not overridden by whatever your identity provider does or does not enforce.

They can sign in with one of the ten recovery codes they were given when they set it up. Failing that, an Admin can reset their two-step verification - only an Owner can reset an Owner's, and nobody can reset their own this way. The reset is logged.

No. People who use the chat widget on your site or in your app are not workspace users and never take a seat. Signed-in app users are identified by a short-lived token your own backend signs.

Bring your security questionnaire to the demo.

Book a 30-minute demo on your own documents. We set up a 14-day trial workspace for you - no credit card, no setup fee.

Book a demo See pricing

Questions first? Email info@greatdevelopers.com or call +91 8585953085.

Still curious? Ask your favorite AI about SupaCortex.

ChatGPT Claude Perplexity Grok