Index

A

Account linking5.7
Accounts and access14.2.5
Acknowledgement4.6 7.5.1
Adding a local user4.2.2
AI assistants (MCP)9.4
API token3.4 4.7 4.8.1 5.10 6.11 9.2 9.5 10.1
API tokens9.2
Appetite bands6.6.5
Approval workflow4.4.5 4.5 6.10 6.11
Archive11.3.2 11.3.5
Article 30 register6.10
Asset4.4.3 4.8.1 6.4 8.3.1 8.6
Attachment14.1
Attributes and account matching5.6.3
Audit chain verification fails13.4.8
Audit entries5.4.6
Audit finding4.4.3 6.4 6.7 7.7.1 8.3.1
Audit log1.2.1 4.4.8 6.2 10 10.2 10.3 10.8 13.1.3
AUTH_SECRET14.2.3
Authentication9.4.3

B

Back up and count rows12.3.2
Background jobs1.2.2
Backup11 11.1 11.1.2 11.1.3 11.2 11.3.1 11.3.2 14.2.4
Backups14.2.4
Before you begin2.1
Before you run it8.5.1
Before you start5.6.1
Before you upgrade12.1
Bootstrapping the first administrator2.6
Branding6.3
Build and start12.3.5
Built-in role matrices4.8.3
Bulk changes and rules7.7.3
Bundle format in brief8.5.4
Bundle loader3.4 6.6.7 6.9 7.7.3 8.1 8.5 8.5.4 8.6
Business unit4.4.3 4.8.1 8.3.1 8.6

C

Caddy1.1 1.2 1.5 2.3 2.4.1 2.4.2 2.9 13.4.4
Caddy does not get a certificate13.4.4
Calculation matrix6.6.4
Changing the scale on a live register6.6.7
Changing your own password5.2.2
Choose how HTTPS is provided2.4
Choosing a method8.1
Classification6.2 6.6.1 6.6.2 6.8 6.12 8.2 8.3.1 8.5.4
Classifications6.6.2
Cleaning up after upgrades12.6
Comment7.7.1 7.7.2
Common problems13.4
Compliance framework packages8.4
Components1.1
Configuring SMTP7.2
Container hardening1.2.3
Container health checks13.1.2
Control4.4.9 4.8.1 6.2 6.4 6.5.1 6.7 7.5.1 8.3.1
Control testing4.4.9 6.7 7.5.1 10.3
Control testing settings6.7
Copying backups off the server11.1.3
Create the .env file2.3
Creating a custom role4.4.7
Creating a rule7.7.1
Creating a token9.2.1
Creating and changing fields6.5.3
Creating and editing a group4.3.2
CSV import6.5.3 8.1 8.3 8.3.2 8.3.3 8.4.1 8.6 10.1
CSV imports8.3
Custom field4.4.3 4.4.6 4.8.1 6.2 6.5 6.5.1 6.5.3 6.5.4
Custom fields6.5

D

Dashboard2.6 4.4.3 4.6 4.8.1 4.8.2 6.6.5
Data Liaison4.4.3 4.4.4 4.4.6 4.5 4.6 4.8.1 4.8.3 7.5.1
Data processing agreement7.5.1
Database roles1.2.1
Deactivating and reactivating4.2.4
Delegating user administration4.2.7
Deleting a group4.3.4
Deleting a user4.2.6
Deliverability7.10
Demo data8.7
Development and demonstration only3.5
Disk full13.4.7
Docker Compose1.1 1.3 7.9.1 12.3.5 12.4 13.4.3 13.4.5 14.2.7
DPIA4.4.3 4.4.5 4.5 6.10 6.11 7.5.1

E

Editing a template7.5.2
Editing a user4.2.3
Effect of changes on open sessions4.7
Email is not sent13.4.5
Encrypting backups11.1.2
Endpoint and tokens5.9.1
Enrollment5.4.1
Environment variable2.3 2.4.3 2.8 2.9 3 3.1 3.2 11.4
Evidence4.4.3 4.8.1 7.5.1 9.4.2 10 10.6 10.7 10.8
Evidence file fingerprints10.6
Exactly how Own is evaluated4.4.3
Example: Microsoft Entra ID5.6.6
Example: Okta5.6.7
Exception4.4.3 4.4.4 4.4.10 4.5 7.5.1 7.6 7.7.1 8.3.1
Expiry, revocation and restores9.2.3
Export8.3.2 10.2.3 10.8 11.3.2 11.3.3 11.3.4
Exporting10.2.3
Exporting and the scheduled snapshots11.3.4

F

Field types6.5.2
File rules8.3.2
Files moved onto evidence10.7
First sign-in2.7
First start2.5
First-time migration8.6
Framework content shipped with the source8.4.2

G

GDPR8.4.2
Group4 4.3 4.3.1 4.3.2 4.3.3 4.3.4 4.4.3 6.2
Groups4.3

H

Hash chain10.3 12.3.6 13.1.3 13.4.8
Health check2.5 9.1
Health checks13.1
Host requirements1.3
How accounts come into existence4.2.1
How custom fields appear6.5.4
How email is sent7.1
How levels combine4.4.2
How rules are delivered7.7.2
How settings are stored and applied6.1
How the components connect1.2
How values reach the containers3.1

I

IdP-initiated sign-in5.6.5
Importing a package8.4.1
In-app snapshots11.3
Incident classifications6.8
Install the release12.3.4
Instance settings (.env)3.2
Integration points9.1

K

Keeping an external record10.8.1
Keeping up to date14.2.7
Key rotation5.4.5
Known limits14.3

L

Label6.2 6.4
Labels6.4
LDAP5.5 1.5 4.2.3 5.1 5.7 5.8 10.1 14.1
Limits5.9.4
Limits, auditing and reachability9.4.4
Local passwords5.2
Locked out of administrator accounts13.4.9
Logs13.2

M

Magnitudes6.6.3
Map of the settings pages6.2
Mapping requirements8.4.3
MCP6.2 9.1 9.4 9.4.1 10.5
migrate fails13.4.2
Migration1.1 1.2 1.2.1 2.5 3.2 8.6 12.5 13.4.2
Modules4.8.1
Monitoring14.2.6

N

Network ports1.5
NIST SP 800-538.4 8.4.2 8.7 10.8
Notification rule1.2.2 3.6 4.8.1 6.2 7 7.4 7.7 8.7
Notification rules7.7
Notification template4.4.3 7.5

O

Operator checklist14.2
Operator script variables3.4
Option 1: the bundled Caddy2.4.1
Option 2: the bundled Caddy with your own certificate2.4.2
Option 3: your own reverse proxy2.4.3
Owner4.2.6 4.3.1 4.4.3 4.4.9 8.3.1 8.3.2 8.6 10.3

P

Password3.2 4.2.5 5.2 5.2.1 5.2.2 5.8 7.2 10.1
Password policy5.2.1
Permission reference4.8
Permissions4 4.4.1 4.8 9.3 10.1
Personal data breach7.7.2 8.3.3
Plan the file changes12.3.1
Policy portal4.4.4 4.6 4.8.1
Policy settings6.9
Post-installation checklist2.8
Privacy settings6.10

Q

Questionnaire4.4.3 4.8.1 7.5.1 8.2

R

Rate limit3.2 5.9.4 9.3 14.1
Recalculate all risks6.6.6
Record of processing4.4.3 6.5.1 7.5.1
Record types and columns8.3.1
Remediation project1.1 2.9 3.2 4.4.3 4.8.1 6.4 6.5.1 8.3.1
Report schedule7 7.8 7.9 8.7
Requiring two-step verification5.4.3
Resetting a password4.2.5
Resetting a user's two-step verification5.4.4
Residual risk8.5.4
Restore3.4 9.2.3 11 11.2 11.2.1 11.3.5 11.4 12.5
Restore drill11.4
Restoring a server backup11.2
Restoring a snapshot11.3.5
Restoring in place on the same server11.2.1
Retention10.4
Review4.4.3 4.4.4 4.4.5 4.4.6 4.5 7.5.1 7.6 8.1
Rights on configuration modules4.8.2
Risk appetite6.6.1 6.6.5 6.6.6 7.5.1
Risk score6.6.1 8.3.1
Risk Settings6.6
Roles4.4
Rollback12.2 12.3.3 12.5 12.6
Rolling back12.5
Rotating AUTH_SECRET14.2.3
Rotating the IdP certificate5.6.8
Row counts13.3
Running an update12.2
Running it8.5.2
Running it again8.5.3
Running several instances on one server2.9

S

SAML5 5.6 5.6.2 5.6.6 5.7 5.8 10.1 13.4.6
SAML single sign-on5.6
Scheduled reports delivery7.8
Scheduler7.6 1.2.2 7.5.1 7.9 14.2.7
Scheduling11.1.1
SCIM4.2.3 4.3.3 5.7 5.9 5.9.1 5.9.3 5.9.5 10.1
SCIM provisioning5.9
SCIM-managed groups4.3.3
Searching and filtering10.2.1
Secrets14.2.2
Security alerts10.5
Separation of duties4.5 6.11
Server backups11.1
Service account5.5 9.5
Service accounts and token practice9.5
Session4.2.3 4.7 5.2.4 5.10 6.2 6.11 14.1 14.2.5
Sessions and sign-out5.10
Sessions page: token lifetime, storage and separation of duties6.11
Set by Compose and the image3.3
Setting up Microsoft Entra ID provisioning5.9.5
Settings5.6.2
Settings checklist for a new instance6.12
Settings that live in the application3.6
Sign-in methods at a glance5.1
Sign-in throttling and lockout5.3
Signing11.3.3
Single sign-on errors13.4.6
SMTP2.1 7.2 7.3 7.9 7.9.1 9.1 10.5 13.4.5
SSO only and break-glass administrators5.8
Staff and portal-only users4.6
Storage5.2.3
Supported browsers1.4
Supported operations5.9.2

T

Tag a rollback image12.3.3
Template keys and their variables7.5.1
Templates7.5
Testing email7.3
The Approve right4.4.5
The audit chain13.1.3
The Audit Log page10.2
The built-in roles4.4.6
The bundle loader8.5
The delivery log7.9
The hash chain10.3
The health endpoint13.1.1
The Notifications page7.4
The permission model4.4.1
The REST API for administrators9.3
The Review right4.4.4
The sign-in sequence5.2.4
The sign-in step5.4.2
The stack does not start: a variable is not set13.4.1
Third party4.4.3 4.8.1 6.4 6.5.1 6.6.2 8.3.1 8.6 9.4.2
Throttling5.3 5.4.2 10.1
Time zone5.6.3 5.9.5 7.6
TLS and the network14.2.1
Transfer impact assessment7.5.1
Treatment4.4.3 8.5.1 8.5.4 8.6
Troubleshooting7.9.1
Turning a template off7.5.3
Turning it on9.4.1
Two-step verification5.4 5.2.4 5.4.1 5.4.2 5.4.3 5.4.4 5.4.6 10.1

U

Unpack the release2.2
Upgrade1.3 2.2 2.4.2 4.4.6 11.1.2 12 12.1 12.6
Upgrading an installation from before October 202612.7
Upload link9.4.4
User4 4.2 4.2.2 4.2.3 4.2.6 4.2.7 4.6 5.4.4
User accounts4.2
Using the audit log as evidence10.8

V

Verify and record12.3.6
Verifying the chain10.3.1
Version1.4 8.4.1 12.2 12.3.3 12.3.6
Viewing a change10.2.2

W

web is unhealthy or keeps restarting13.4.3
What a group does4.3.1
What a new installation already contains8.2
What a new installation contains6.6.1
What a response must satisfy5.6.4
What a snapshot contains11.3.1
What a token can do9.2.2
What an assistant can do9.4.2
What an import does8.3.3
What else to keep11.1.4
What else to watch13.1.4
What is logged10.1
What provisioning may and may not do5.9.3
What the product enforces14.1
What the update does12.3
What to do if verification fails10.3.2
When an update fails12.4
Where backups are assembled11.3.2
Where custom fields apply6.5.1
Where identity is administered4.1
Worked example: auditor, read-only4.4.8
Worked example: control owner4.4.9
Worked example: delegating exception decisions4.4.10
Worker1.1 1.2 1.2.2 7.1 7.3 7.6 7.9.1 13.4.5