mirror of
https://github.com/vectorize-io/hindsight.git
synced 2026-09-14 19:31:49 +08:00
Ben
82729887a0
* blog: Enterprise Features in Hindsight Cloud An overview of the enterprise capabilities Hindsight Cloud offers, with each entry stating the failure it prevents rather than only what it does: - Single sign-on over OIDC or SAML, with domain verification, provisioning on first sign-in, and no password fallback once a domain is routed. - Organization-wide MFA enforcement across TOTP, WebAuthn, SMS and email, gated on the session having cleared a factor rather than merely having one enrolled. - Idle session timeout. - Owner, Admin and Member roles. - API key expiry and per-bank scoping, plus scoped child keys as the isolation primitive for multi-tenant applications. - Audit logging, opt-in per bank. - Memory Defense on the retain path, and the Enterprise detector set. - Bring your own cloud, with PrivateLink on AWS. Describes capabilities only. No compliance or certification claims, no regional hosting claims, and no implementation detail or internal identifiers. Cover is w03 (aperture): layers closing around a memory graph. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AE4NCnCKXUzNDF3N9FaQja * blog: apply review feedback on enterprise features Four corrections from review: - MFA factors were wrong. The post listed authenticator apps, WebAuthn passkeys, SMS and email. Cloud offers two: an authenticator app (TOTP) and an emailed one-time code. The four-factor list was the underlying identity provider's capability, not what Cloud exposes. - Idle session timeout is now enabled for every organization, so it moves from Enterprise to all plans. - Webhooks were missing entirely. Added as an Enterprise section: events on completed retains and consolidations, HMAC-signed payloads, asynchronous delivery with retries and per-delivery history, and Memory Defense violation alerts that can be routed to a SIEM. - On-premise deployment was missing. Added alongside bring-your-own-cloud, for the case where data cannot leave your own hardware rather than just your own cloud account. The at-a-glance table, description, and FAQ are updated to match. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AE4NCnCKXUzNDF3N9FaQja * blog: describe private connectivity as provider-neutral The previous wording put the infrastructure template and private connectivity behind "on AWS that includes...", which reads as though those are AWS-only capabilities. They are not tied to one provider. Both are now described as part of the bring-your-own-cloud deployment generally: the deployment ships the templates you apply in your own account, and traffic uses whichever private-endpoint mechanism your provider offers. The FAQ answer is updated the same way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AE4NCnCKXUzNDF3N9FaQja * blog: drop the infrastructure-template paragraph from bring your own cloud Leaves the section on the two claims that matter: the deployment goes into your own cloud account, and private connectivity keeps traffic off the public internet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AE4NCnCKXUzNDF3N9FaQja * blog: date the enterprise features post 2026-09-03 The post was drafted on 09-01 and changed substantially after that across four rounds of review: MFA factors corrected, idle session timeout moved to all plans, webhooks added, on-premise added, and private connectivity described as provider-neutral. Dating it to publish day rather than draft day, before it goes live rather than after. Filename, frontmatter date and slug move together. The 09-01 cross-link to the June-August roundup is unchanged and correct. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AE4NCnCKXUzNDF3N9FaQja --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
