Why it matters
Whoever controls your Upmo AI account controls your agents, and your agents can act in your accounting, your inbox and your CRM. That makes the sign-in the most valuable door in the building.
Passwords get phished and reused. A passkey can't be typed into a fake website, because it only works on the real one.
For a business there's a second risk: people who leave. With single sign-on, access follows your identity provider. Disable someone there and they can no longer sign in to Upmo AI.
How it works
Zero trust applies to people too. Being signed in isn't enough for the changes that matter most.
- 1
Sign in
Use the passkey on your phone or laptop. Nothing to remember, and nothing to type into a fake website.
- 2
Work as usual
Start tasks, read results and approve actions.
- 3
Confirm again
Changing roles, adding API keys or editing security rules asks for your passkey once more.
An example
An unlocked laptop
A colleague leaves their laptop open at a café. Someone sits down and tries to add themselves as an admin. Upmo AI asks for the passkey again. Without the owner's fingerprint, the change doesn't happen.
What you control
- Who has which role in your workspace.
- Whether your team signs in with SSO through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace.
- Which changes need a second confirmation.
- A record of every sign-in and every security change.
For your security team
- Passkeys use the WebAuthn standard. Upmo AI stores only the public key.
- Single sign-on uses SAML 2.0, so it works with Okta, Microsoft Entra ID, Google Workspace and other identity providers.
- Passkeys come first. Teams that need passwords can use them, and stored password data is encrypted.
- Sensitive changes require a fresh confirmation, not just a valid session.
- Sign-ins, approvals and role changes are logged with time and device.
The code is open source, so your team can read how each of these works. Questions? Email security@upmo.ai.