Security
Security as a feature, not a checkbox
Iskue runs inside your perimeter to begin with — and the application layer holds its own: modern authentication, scoped authorization on every read path, and an audit trail your reviewers will actually enjoy.
OIDC single sign-on
Optional login with Google and Microsoft (Azure AD). The authorization-code flow is driven by the backend and mints the same session token as password login. New users are auto-provisioned; existing accounts link on a provider-verified email. No provider configured? The app simply stays password-only.
Two-factor authentication
Optional TOTP (RFC 6238) for local accounts: authenticator-app enrollment, a two-step login challenge, and self-service disable and rotate. Recovery codes are single-use and stored bcrypt-hashed.
Stateless JWT sessions
Authentication is token-based and stateless, which keeps horizontal scaling simple — any node can serve any request.
Roles & guards
Global admin/member/guest roles plus per-project admin/member/viewer. User management includes a last-admin guard, so the system can never lose its final administrator by accident — and self-registration closes with a single flag once your team is on board.
Audit log
Who changed what, and when — kept where your auditors can find it.
Rate limiting
Per-IP limits on the login surface take the sting out of brute-force attempts; the wider API is limited per user — with spoof-resistant client detection behind reverse proxies.
Scoped visibility
Restricted-ticket visibility is enforced on every read surface — boards, search, reports and the API alike. If you can't see a ticket, no surface leaks it.
Signed webhooks
Outbound webhooks are signed with HMAC-SHA256 so receivers can verify every payload really came from your Iskue.
Your infrastructure
Self-hosted means your data residency question has a one-word answer: yours. Nothing leaves the servers you run.
See Iskue on your own screen
A demo takes half an hour. A pilot runs on your servers, with your data, from day one.