Security & Compliance
Generate Enterprise gives organizations enterprise control over authentication and data. It supports Single Sign-On with Okta, maps identity-provider groups to teams, isolates each workspace’s data with encryption at rest, and gives administrators role-based control over access, retention, and deletion. Generate is self-hosted / VPC-deployable, so an organization’s documents stay within the environment it controls.
What Single Sign-On does Generate support?
Section titled “What Single Sign-On does Generate support?”Generate supports Single Sign-On with Okta using OpenID Connect (OIDC), configured by an administrator under Admin Settings → SSO with an OIDC Test connection check during setup. Additional identity providers (Microsoft Entra ID, Auth0, Google, Keycloak, ADFS) and protocols (SAML 2.0, LDAP) appear in the admin interface as roadmap options and are not yet enabled.
How are user accounts provisioned?
Section titled “How are user accounts provisioned?”Accounts are provisioned just-in-time when a user first signs in through SSO. Per identity provider, an administrator chooses the mode: invite only (default — the user must be invited first), auto-create (create unknown users on first login), or deny (reject unknown users).
Can identity-provider groups map to Generate teams?
Section titled “Can identity-provider groups map to Generate teams?”Yes. Group-to-team mapping maps an identity provider’s group claims to Generate teams: users in matched groups automatically join the corresponding team on first SSO login, and unmatched users fall back to the Default Team. It is configured in the SSO setup wizard.
How does Generate protect and isolate data?
Section titled “How does Generate protect and isolate data?”Generate isolates each workspace’s data and is self-hosted / VPC-deployable on Kubernetes, so documents stay within the organization’s environment. Sensitive fields (PII, credentials) are encrypted at rest, secrets are held in a secret manager with only references stored in the database, and access is controlled by roles (super admin, admin, user, viewer) and team-based privileges. Administrators control data-retention policies and can fully delete a workspace’s data after a configurable window.
Sources and references
Section titled “Sources and references”- OpenID Connect: openid.net
- Full customer documentation: the
admin/sso/*pages on the Generate Enterprise docs site.