> For the complete documentation index, see [llms.txt](https://docs.silkline.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.silkline.ai/configuration/secure-configuration-guide.md). # Secure Configuration Guide Secure administrator access, permissions, sharing, integrations, and data handling for your Silkline organization Use this guide to secure your Silkline organization before adding users or processing sensitive data. It covers the settings your administrators set up and control, the secure default for each, and how to check your organization against those defaults. **Audience:** Customer organization administrators and their identity-provider administrators. **Version:** 1.22. **Last reviewed:** October 28, 2026. ## Obtain and use this guide This guide is available without signing in. Bookmark this page or obtain its [Markdown version](https://docs.silkline.ai/configuration/secure-configuration-guide.md). Use the checklist during onboarding, when administrative access changes, and during your organization's periodic access reviews. Record any exception to a secure default, its approver, and its review date. For setup, recovery, or settings that require Silkline assistance, contact . Report suspected unauthorized access to . Include your organization name and affected account or resource; do not include passwords, setup links, integration secrets, or sensitive attachments in email. Support requests sent from **Get help → Contact support** are not approved for CUI or ITAR data. In FedRAMP-enabled and ITAR-enabled organizations, the form shows this warning. Keep CUI and ITAR data out of support messages and screenshots. ## Secure defaults A new Silkline organization starts with these settings. Keep each default unless a reviewed business need requires a change. | Setting | Secure default | Where to change it | Recommendation | | ---------------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | Role-based access control | On; cannot be turned off | — | Assign least-privilege roles | | Default role for new users | Viewer (no role) | **Organization Settings → Users and Access** | Keep Viewer; grant other roles per person after approval | | Administrators | None until Silkline assigns the designated administrator | **Organization Settings → Users and Access** | Limit Admin; keep a second administrator for recovery | | SSO connection | None | **Settings → Single sign-on** | Connect your identity provider and require MFA there | | Send on behalf | Off | Turns on when you authenticate a sending domain | Authenticate a sending domain only once its use is approved | | API keys | Off; no keys | Silkline support enables; **Organization Settings → API keys** | Enable only for approved integrations; one named key per system | | Public Files | None | **Organization Settings → Public Files** | Publish only documents approved for public distribution | | File storage | Silkline storage | **Organization Settings → File Storage** | Keep Silkline storage; unavailable in FedRAMP and ITAR organizations | | Integrations | None | Silkline support creates; Admins edit | Use scoped service identities and only approved data-flow directions | | Supplier and resource shares | None | Each resource's **Share** menu | Share only with approved recipients | | Order send behavior | Manual release | Each supplier's **Order Defaults**, and **Send to supplier** on each order | In FedRAMP-enabled organizations, choose Auto-send only once the Send Order template contains no CUI or ITAR data | ### Check your settings against the defaults Compare your organization's current values with the table above: * In the app, open each location in the **Where to change it** column. * Through the Silkline API, read your organization's settings, administrators, and API keys with an API key. The API returns JSON, which you can keep as a record of each review. See the [API guide](https://github.com/Silkline/client-app/tree/development/docs/for-customers/api.md). * Compare automatically with the [machine-readable secure defaults](https://app.silkline.ai/.well-known/fedramp/secure-configuration-guide). This JSON document lists each row of the table above with the API query to run and, under `checks`, the response field and expected value for that setting. Rows without checks need a manual review. ## Secure the first administrator account 1. Coordinate provisioning with your Silkline contact. Confirm the organization name, approved email domains, designated administrator, and application URL for your deployment. 2. Use an individually assigned work account. Protect its mailbox with your organization's approved multifactor authentication (MFA), and restrict mailbox delegation and forwarding. Email sign-in and invitation links grant access to their recipient; keep them confidential. 3. Open the invitation or sign-in page from the confirmed application URL. Verify the hostname before authenticating. If a local password is used, choose a unique password and store it in an approved password manager. 4. Open **Organization Settings → Users and Access**. Confirm that you are in the correct organization and hold the **Admin** role. Check the default role for new users before inviting anyone or enabling SSO. 5. Establish a second, explicitly authorized administrator for recovery and continuity. Have that person verify their own sign-in and administrative access. Use Admin only for people who need organization-wide authority. Do not share administrator accounts or reuse another administrator's sign-in links. ## Configure SSO and enroll passkeys An identity provider (IdP) authenticates your organization's users. Silkline controls their application roles and permissions. Configure both layers. 1. Have Silkline verify your organization's SSO email domains. Limit assignment to the Silkline application in your IdP to approved users or groups. 2. As an Admin, open **Settings → Single sign-on**. Follow [Self-service SSO setup](/configuration/sso-configuration/self-service-sso.md) and copy the exact redirect URI displayed for your organization. 3. Give the setup link only to the intended IdP administrator. Each link works once and expires after seven days; revoke unused links from **Outstanding setup links**. 4. In your IdP, require your organization's approved MFA for Silkline access, and enroll approved passkeys or security keys through the IdP's security settings. 5. Test sign-in in a private browser window with both an administrator and an ordinary user. Confirm the IdP's policy applies and Silkline assigns the intended role. Verify that an account without IdP application access cannot enter through SSO. MFA and passkey enforcement are IdP controls. Silkline's sign-in also supports password and email-link authentication, so configuring SSO does not by itself disable other sign-in methods. Ask support to review the available sign-in and recovery paths before relying on an SSO-only policy. The Silkline desktop app signs in through your default web browser, so the same IdP policy applies there. See [SSO Configuration](/configuration/sso-configuration.md) for supported providers. ## Assign roles **Admin** is Silkline's top-level customer administrative role. It includes organization settings, user-role assignment, SSO setup, integration editing, API keys, and Public Files. A user who can assign roles can assign Admin, so treat that permission as administrative authority. | Role | Security implications | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Controls organization-wide access and security-sensitive settings. Limit membership and review each assignment. | | Buyer | Can conduct procurement and send supplier communications; can edit email templates. General organization settings require Admin permissions. | | Supplier Quality | Can manage supplier and quality information, send evaluations, and send requests for quote. Review access to externally shared assessment content. | | Material Planner | Can manage parts and send supplier check-ins. Review the recipients and information exposed by those messages. | | Punchout Buyer | Has purchasing capabilities for punchout-supporting suppliers. Review purchasing and approval authority separately. | | Finance & Legal | Can manage suppliers, including approval status and denied-party screening reviews, plus terms and budgets. Cannot send purchase orders. | | Collaborator | Can contribute sourcing information, including requests and quotes. Grant only when editing is needed. | | Viewer | Can view without editing. Viewing data still creates a confidentiality responsibility. | A member's permissions come only from their assigned roles. The default role applies to every new member, including SSO users created on first sign-in. Changing it does not change existing members' roles. See [Users and Access](https://github.com/Silkline/client-app/tree/development/docs/configuration/profile-and-settings/organization-settings/organization-users.md). ## Control supplier and share-link exposure Before sending an RFQ, PO, check-in, evaluation, or issue, verify the recipients, message body, resource details, and attachments. Include only information approved for those recipients. In organizations with FedRAMP enabled, there are no anonymous share links. **Anyone with link** is unavailable, and every supplier link, including one sent before FedRAMP was enabled, asks the recipient to sign in. Recipients sign in with the email address the link was sent to and see only resources shared with that address. In other organizations, supplier links can expose resource information without a Silkline sign-in. Do not forward links beyond the approved audience or place them in public tickets or websites. RFQ email shares and links created with **Copy share link** expire after 30 days; check the expiration shown for each resource. To remove a recipient's access, open the resource's **Share** menu and select **Unshare**. Outside FedRAMP-enabled organizations, guest links can remain usable until they expire; contact support if a link needs immediate revocation. Revocation cannot recall data a recipient has already downloaded. See [Supplier access](https://github.com/Silkline/client-app/tree/development/docs/for-suppliers/accessing-rfqs-and-pos.md). To verify sign-in is required, open a supplier link from a sent RFQ or PO in a signed-out browser. In a FedRAMP-enabled organization, the page asks you to sign in and shows no resource details. Confirm the Share menu has no **Anyone with link** section. ### Public Files **Organization Settings → Public Files** is for documents approved for public distribution. Uploading publishes a file immediately; its URL requires no sign-in and does not expire. Use **Unpublish** to disable a URL, and verify it in a signed-out browser. See [Public Files](/configuration/public-hosted-files.md). ### Custom file storage Custom file storage is not available in FedRAMP-enabled or ITAR-enabled organizations. Silkline stores their files in its own storage, inside the authorization boundary. If custom storage was set up before FedRAMP or ITAR was enabled, files already in that bucket stay there; disable custom storage to store new files with Silkline. In other organizations, **Organization Settings → File Storage** can store new uploads in an S3 bucket in your own commercial AWS account. That bucket is outside Silkline's FedRAMP authorization boundary, and you are responsible for its access policy, encryption, and logging. Enabling it requires the Edit Integration permission. * Keep Silkline storage unless your data-handling requirements permit the bucket's account and region. * Restrict the role's trust policy to the Silkline principal ARN and the ExternalId shown at setup, and grant it only object access on that bucket. * Rotate the ExternalId if it may have been exposed. See [Custom File Storage](/configuration/custom-s3-storage.md). ## Protect integration credentials For each integration, use a dedicated external service identity with the minimum necessary access, and confirm the pull and push directions before enabling a flow. Submit secrets only through **Organization Settings → Integrations → Secrets**; saved secrets cannot be viewed after submission. To rotate a credential, issue a replacement in the external system, save it in Silkline, verify synchronization, and revoke the old credential at its issuer. Updating the secret in Silkline does not revoke the old credential. Disable unneeded flows, and revoke external credentials when retiring an integration. See [Managing Integrations](/configuration/integrations/managing-integrations.md). ### API keys **Organization Settings → API keys** issues credentials that external systems exchange for 24-hour access tokens to the Silkline API. Silkline support enables the page for your organization. Creating and deleting keys requires the Admin role. Every key has full read and write access to your organization's data without a user sign-in. * Create one named key per consuming system. * Store the secret in a secret manager at creation; it is shown once. * Replace a key on personnel change or suspected exposure, then delete the old key. A deleted key cannot obtain new tokens; an issued token stays valid for at most 24 hours. * Review the key list at least quarterly and delete keys without an owner and purpose. See [API Keys](https://github.com/Silkline/client-app/tree/development/docs/for-customers/profile-and-settings/organization-settings/api-keys.md). ## Review email and notifications In **Organization Settings → Email Settings**, approve the From address, sending domains, templates, and copied recipients. Templates apply to the whole organization, and Buyers as well as Admins can edit them. The To, CC, and BCC recipients on the Send Order template are added to every order email, including orders sent automatically. Authenticating a sending domain turns on send on behalf, so outbound email can represent your organization. Email to suppliers that users write in Silkline, and orders sent automatically from the Send Order template, is not approved for CUI or ITAR data. In FedRAMP-enabled organizations, every compose screen and the template editor show this warning, and order and issue PDFs cannot be attached. Suppliers view details through the Silkline link in the email. Keep CUI and ITAR data out of templates, subjects, and messages. Auto-send emails an order to the supplier's order contacts as soon as it is approved, using the Send Order template, with no chance to review the message. In FedRAMP-enabled organizations, the same warning appears wherever Auto-send is chosen: a supplier's **Default send behavior** in its settings and Order Defaults, and **Send to supplier** on an order. Before choosing Auto-send, confirm the Send Order template contains no CUI or ITAR data. Each user controls their own approval email preferences, delegates, and evaluation reminders under **Account**. See [Email Settings](https://github.com/Silkline/client-app/tree/development/docs/configuration/profile-and-settings/organization-settings/email-settings.md) and [User Profile](https://github.com/Silkline/client-app/tree/development/docs/configuration/profile-and-settings/user-profile.md). CSV files, PDFs, and downloaded attachments are copies outside Silkline's access controls. Export only what the recipient needs, and store downloads in approved locations. ## Remove administrative access When an administrator leaves or changes responsibilities: 1. Assign a successor and verify their access before removing the departing administrator, unless immediate containment is required. 2. Remove the departing person's roles in **Users and Access**, and their Silkline application assignment in your IdP. 3. Ask Silkline support to revoke remaining sessions and local sign-in access. **Inactive** status for SSO users affects visibility; it does not block sign-in. 4. Revoke unused SSO setup links, reassign approval delegates, and rotate any integration credentials or API keys the person controlled. 5. Review their shares and Public Files. ## Administrator checklist * [ ] Verify the named Admins and a recovery administrator. * [ ] Confirm the default role is Viewer, and review existing role assignments. * [ ] Configure and test SSO and IdP MFA; revoke unused setup links. * [ ] Confirm send on behalf and sending domains are approved. * [ ] Review API keys: one named key per system, none for retired integrations. * [ ] Confirm every Public File is approved for public distribution. * [ ] Confirm file storage is Silkline storage. Outside FedRAMP and ITAR organizations, a custom bucket must be approved and its role must require the ExternalId. * [ ] Review integration credentials and data-flow directions. * [ ] Review supplier shares, email templates, and notification recipients. * [ ] Confirm email templates contain no CUI or ITAR data, and review which suppliers default to Auto-send. * [ ] Confirm users know that support requests, like supplier email, are not approved for CUI or ITAR data. * [ ] With FedRAMP enabled, confirm a supplier link opened in a signed-out browser asks for sign-in. * [ ] Record exceptions to the secure defaults. ## Maintenance and revision history This guide is updated whenever a customer-configurable security setting, its default, or an administrative workflow changes. | Version | Date | Coverage | | ------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | 1.0 | 2026-09-09 | Administrator lifecycle, SSO and IdP passkeys, permissions, sharing, integration credentials, notifications, exports, and provisioning defaults. | | 1.1 | 2026-09-10 | Desktop app sign-in through the system browser, and the passkey and security-key policy that applies to it. | | 1.2 | 2026-09-16 | Operational logging destinations, credential handling, and verification during infrastructure ownership changes. | | 1.3 | 2026-09-16 | Per-destination verification of infrastructure metrics and AWS account audit events. | | 1.4 | 2026-09-16 | Deployment-cluster metric, log, and collector-readiness verification. | | 1.5 | 2026-09-16 | Browser CSP enforcement, report-only avatar and PDF connection sources, and verification guidance. | | 1.6 | 2026-09-16 | Monitoring and SIEM preparation, notification authority, checker and standby verification. | | 1.7 | 2026-09-16 | Desktop app origin-scoped clipboard policy, browser-permission denial, and customer verification. | | 1.8 | 2026-09-17 | Government SIEM index precedence, collection readiness, and source-specific analysis verification. | | 1.9 | 2026-09-17 | Government application telemetry and installed-client verification. | | 1.10 | 2026-09-22 | RBAC is always enabled; permissions come only from assigned roles. | | 1.11 | 2026-09-23 | Order email template To, CC, and BCC recipients, including buyer and requester variables applied to automatically sent orders. | | 1.12 | 2026-09-23 | Organization API key issuance and deletion. | | 1.13 | 2026-09-23 | Scoped to customer-configurable settings. Secure defaults table, Viewer as the default role, and checking settings through the API. | | 1.14 | 2026-09-28 | Custom file storage in a customer-owned S3 bucket outside the authorization boundary, its trust policy, and ExternalId rotation. | | 1.15 | 2026-10-12 | Finance & Legal role for managing suppliers, terms, budgets, and denied-party screening reviews. | | 1.16 | 2026-10-15 | Machine-readable secure defaults for comparison with the settings API. | | 1.17 | 2026-10-15 | Supplier email, including Auto-send, is not approved for CUI or ITAR data; FedRAMP organizations see a warning and cannot attach order or issue PDFs. | | 1.18 | 2026-10-15 | No anonymous share links in FedRAMP-enabled organizations; recipients sign in with the email address a link was sent to. | | 1.19 | 2026-10-16 | Supplier Quality role can send requests for quote to suppliers. | | 1.20 | 2026-10-19 | Custom file storage is not available in FedRAMP-enabled or ITAR-enabled organizations. | | 1.21 | 2026-10-27 | A new organization has no administrator until Silkline assigns the designated administrator. | | 1.22 | 2026-10-28 | Support requests are not approved for CUI or ITAR data; FedRAMP-enabled and ITAR-enabled organizations see a warning on the support form. |