What you can configure
Team
The tenant’s identity — who it is, who’s in it, and which models it uses internally.General
Team display name and team deletion.
Users
Members, invitations, roles, and per-product access.
Models
LLM and embeddings providers used by NeuralTrust features.
Identity & Access
How people sign in and what the platform lets them do.SSO Configuration
Microsoft Entra ID and generic OIDC single sign-on, with break-glass emergency access.
SCIM Provisioning
Automatic user creation and removal driven by Microsoft Entra ID.
User sync & group mappings
Map identity-provider groups to NeuralTrust team roles and product access.
Password Policy
Minimum length, character classes, and common/personal-info blocks.
Telemetry
Turn TrustGuard and TrustGate telemetry into prioritized alerts and forward them to your SIEM.Alerts
Predefined detection use cases and custom rules over TrustGuard and TrustGate telemetry, with severity, status, and assignment.
Integrations
Forward alert findings to Splunk, Elastic, IBM QRadar, Microsoft Sentinel, Datadog, or a webhook.
Audit & Compliance
Evidence for SOC2 and incident response, plus the platform’s security posture and data-privacy model.Audit Logs
SOC2-grade security event log with filtering, search, and export.
Security posture
Platform-wide authentication, access control, networking, and encryption guarantees.
Data privacy
Data sovereignty, GDPR / HIPAA / SOX compliance, and the privacy-by-design architecture.
Infrastructure
Where the NeuralTrust app and its data plane actually live — and how to deploy them.Custom Domain
Serve the NeuralTrust app on a hostname you own via a CNAME.
Data plane (Advanced)
Provision a hybrid data plane in your own AWS, GCP, or Azure account — or connect an existing one.
Architecture
Control plane, data plane, and deployment modes (SaaS, Hybrid, On-Premises).
Deployment guides
Cloud-specific install guides for AWS, Azure, GCP, Kubernetes, and Docker.
Feature Flags
Feature Flags
Toggle preview and early-access capabilities for the team.
Who can do what
Access to Team Settings is gated by team role — an organization-wide role that sits above per-product roles.| Role | Scope |
|---|---|
| Owner | Full control of the team. Can change the team name, delete the team, configure SSO, manage break-glass users, rotate SCIM tokens, provision data planes, and toggle feature flags. |
| Admin | Day-to-day administration. Manages users and invitations, verifies email domains, edits group mappings, reviews audit logs, and configures SIEM and password policy. |
| Member | Uses the products they have access to. Cannot see Team Settings. |
Recommended setup order
For a fresh team, configure Team Settings in this order:- General — set a human-readable team name.
- SSO Configuration — pick Microsoft Entra ID or generic OIDC.
- Break-glass access — add at least one emergency user before enforcing SSO.
- Password Policy — tighten local passwords for accounts that keep them.
- SCIM Provisioning (Entra ID) — automate user creation and removal.
- Group mappings — map IdP groups to NeuralTrust roles.
- Users — invite anyone not provisioned by SCIM and assign per-product access.
- Integrations — forward alert findings to your SIEM.
- Custom Domain — if you want the app on your own hostname.
- Advanced — provision a hybrid data plane if you’re on a hybrid or self-hosted plan.
Prerequisites
- NeuralTrust account with Owner or Admin role.
- For SSO: administrator access to your identity provider.
- For hybrid provisioning: admin access to the target AWS / GCP / Azure account.
- For custom domain: control over the DNS zone of the domain you want to use.