devbord is ready for the security questionnaire

Single sign-on with OpenID Connect and SAML, SCIM provisioning, a workspace audit log, required two-factor, an IP allowlist and approvals on cards. The features nobody demos and everybody's IT department asks about.

2026-10-13

Every tool reaches the day somebody from IT joins the call and asks four questions: does it do single sign-on, can we switch people off centrally, is there a log, and who approved this. Until this week our honest answer was a thoughtful pause. Now it is yes, four times.

Single sign-on, both dialects

A workspace can sign its members in through the identity provider your organisation already has: Google Workspace, Microsoft Entra, Okta, Keycloak, or anything else that speaks **OpenID Connect** or **SAML 2.0**.

- People with an address on your domain sign in at your provider and land in the workspace without a devbord password. Someone who has no account yet gets one on the spot.
- You can make single sign-on mandatory, and choose how long a session lasts before the provider is asked again.
- You first prove the domain is yours with a DNS record. Without that step, anyone who can set up an identity provider could claim to be anyone, and we would rather not be that kind of product.
- It works in the iPhone and iPad app too.

Set it up under your workspace › Single sign-on.

SCIM: offboarding without the checklist

With SCIM 2.0 your identity provider tells devbord who should have access, so nobody has to remember. A new colleague gets an account and a seat in the workspace. Someone who is removed or disabled over there loses their membership and their sessions here, immediately, and not three weeks later when somebody notices.

An audit log that answers "who did that"

The workspace now keeps a log of everything that matters to an admin:

- **Members**: who was added, removed, invited, or given another role, and whether a person or the identity provider did it.
- **Access**: single sign-on sign-ins and changes, SCIM tokens, changes to the security rules, and support access requests.
- **Projects**: created, archived, deleted, exported, made public or private.
- **Integrations**: API keys, webhooks, deploy hooks, Git connections.
- **Billing**: subscription changes and invoices.

Every line carries who, when and from which address. Filter by person, by kind or by period, and export the lot as CSV. Exporting the log is itself logged, which felt petty when we built it and correct ever since.

For members whose account is managed through your single sign-on or SCIM, the log also shows their sign-ins, failed attempts and password changes.

Two rules for the whole workspace

Under your workspace › Security there are two new switches:

- **Require two-factor authentication.** Members and guests without it have to set it up before they can continue. People who come in through your single sign-on are exempt: your identity provider is already standing guard there.
- **Allow only your networks.** List the addresses or ranges of your office and VPN, IPv4 or IPv6, and the workspace cannot be opened from anywhere else. One more switch applies the same list to the API and the MCP server.

Every change to these rules lands in the audit log, including the one where somebody turns them off "just for a minute".

Approvals on cards

Some cards should not move until somebody has said yes. So now you can ask.

- Request approval from one person or several, with a note, and decide whether everyone has to agree or one yes is enough.
- Each approver approves or rejects once, with a comment. One rejection rejects the request.
- The card shows where it stands, the board can filter on cards waiting for approval, and the cards waiting for *you* show up under My cards.
- Earlier requests stay on the card as history, so "who signed this off" has an answer in March as well.
- Automation knows about it: rules can react to approval requested, approved and rejected, and a rule can request approval by itself. Webhooks fire on all three.
- Approving from your phone works in the iOS app.

Also in this round

Webhooks got a delivery log with a resend button and secrets you can rotate, and scheduled maintenance on a status page now starts and ends by itself.

Where it lives

Approvals are part of Standard. Single sign-on, SCIM, the audit log and the security rules are part of Premium. All of it is live now; the next time IT joins the call, let them ask.

devbord · Pricing: one flat price per team · News · API documentation · Support: help and contact · Privacy: what we can and cannot see · Terms of service · Privacy policy · Error tracking for dev teams, Sentry-compatible · Time tracking and invoicing for dev teams · Status pages with uptime monitoring and incidents · Changelog and release notes from done cards · A Trello alternative for dev teams · A Sentry alternative that keeps your SDKs · A Linear alternative with error and time tracking · A Jira alternative for small dev teams · An Asana alternative for software teams · A ClickUp alternative with error tracking and invoicing · A Toggl alternative with a board and invoicing · A Harvest alternative with a kanban board · A Statuspage alternative with monitoring built in