Secura SSO
Identity and access control for organisations that have to prove who did what.
Secura SSO gives your people one login across your services, gives you control over exactly what each of them can reach, and leaves an audit trail built for scrutiny rather than for debugging.
What it does
- One sign-on
-
A single account across your internal and public-facing services. Each organisation's users are kept separate in the database, not merely filtered in the application, so a fault in one service cannot expose another tenant's users.
- Works with the logins you already have
-
Staff can sign in through an identity provider you already run, per organisation, with a step-up challenge required for sensitive actions. Authentication to that provider can use signed key assertions rather than a shared secret.
- Access by policy, not job title
-
Rules are expressed as attribute and policy-based conditions, tested in a simulator against real scenarios, and only then enforced. You can see what a rule would have done before it does it.
- Joiners and leavers
-
Accounts provisioned and deprovisioned automatically from your HR or directory system, so access ends when employment does rather than when someone remembers.
- Strong authentication
-
Passkeys and hardware security keys, authenticator apps, and passwordless sign-in. Tokens can be bound to the client that requested them, so a stolen token is not usable elsewhere.
- Audit
-
A record of every authentication and authorisation decision, including the ones that were refused. Refusals are usually the ones an investigation needs.
Standards
Built on published specifications, so it connects to what you already run, your integrators can read the contract before committing, and you are not locked to us.
Our relying-party client library is published on Maven Central as io.cairnova.secura:secura-oidc-client, with no third-party dependencies.
How it is built
| Service identity | Zero-trust service-to-service authentication using mutual TLS with short-lived certificates issued from an internal certificate authority. |
|---|---|
| Secrets | Held in a managed vault with automatic unsealing, never in configuration files or images. |
| Tenant separation | Enforced in the database and in the cache layer, with opaque tenant-scoped identifiers so a subject identifier in one tenant means nothing in another. |
| Monitoring | Metrics, logs, traces and alerting across the whole estate, self-hosted rather than sent to a third-party service. |
| Hosting | United Kingdom — AWS London (eu-west-2). Release images are built once and deployed by an approval-gated pipeline; production never builds from source. |
Where we are
Secura SSO has run in production since September 2026, hosted in AWS London. It is the identity layer beneath Secura SMS, our school management platform, which serves live users in Nigeria — real staff signing in every day, not a pilot environment. It is also the sign-in for every other Cairnova product, including the Casework prototype.
We run it ourselves before we ask anyone else to. It has not yet been deployed for a third-party customer in the UK and is not under contract with one, and we would rather tell you that than let you discover it during due diligence.
We are available for pilot deployments, and for integration through a main contractor already on your framework.
For integrators and security reviewers. We will complete your security questionnaire, provide an architecture walkthrough, and support a proof of concept against a non-production tenant. Email info@cairnova.io.