For mid-market
At 300 people, integrations stop being nice-to-have.
Your IdP, your MDM, your ITSM — they're already chosen, deployed, and load-bearing. A credential platform that doesn't slot into that stack isn't a platform; it's a project. Clavitor ships the integrations a 100-to-500-user org actually has.
Identity — full Microsoft Entra ID support
Most mid-market orgs run on Microsoft 365 + Entra ID (formerly Azure AD). Clavitor doesn't stop at "we support SAML." The Entra ID surface Clavitor uses end-to-end:
Enterprise SSO from the app gallery
Configure Clavitor as an Entra Enterprise Application via SAML 2.0 or OpenID Connect. Assign users or groups directly in Entra. No app proxy, no on-prem connector — your tenant already has everything required.
Group claims → vault scopes
The same Entra security groups that gate your Microsoft 365 apps gate Clavitor vault scopes. Move a user into the "Engineering" group and their vault access updates on next sign-in. No parallel directory.
Conditional Access compatible
Clavitor's SSO honors MFA assertions, device-state claims, and risk signals from your Entra Conditional Access policies. A user denied by your access rule is denied at Clavitor too — your existing access logic stays the single source of truth.
Microsoft Authenticator + FIDO2 at the IdP layer
The same hardware key or Authenticator push your users already have for Microsoft accounts gates Clavitor sign-in. No separate enrollment, no "Clavitor MFA token" to roll out.
Other supported IdPs: Google Workspace, Okta, JumpCloud, OneLogin, and any standard SAML 2.0 or OIDC provider.
Audit logs you can take to your SIEM
Every credential action is recorded in a hash-chained audit trail. You filter it in the vault and export the view as a CSV file, up to 500 events per export, and load that file into your SIEM yourself. There is no SIEM connector or live feed. What the SIEM integration is today →
The rest of the stack a mid-market org runs
MDM
Intune, Jamf, Kandji — push the Clavitor browser extension and CLI installer via your existing MDM profile. Hardware-key requirements are enforced at sign-in, not negotiated at install time.
ITSM / ticketing
Jira Service Management, ServiceNow, Freshservice — credential requests, scope changes, and recovery flows can post to your ticketing system via webhook for audit and approval workflows.
Multi-region by default
26 Points of Presence (POPs) across six continents. Your London team reads from lon1, Silicon Valley from sv1, Singapore from sin1 — same vault, <60ms reads from any continent. Every vault can keep an encrypted spare copy in a second city: in the same region by default, or on the far side of the world.
Compliance documents on the public site
DPA and subprocessor list are linked publicly — no NDA gate, no redlining of standard terms. We do not hold a SOC 2 Type II attestation today; controls are self-assessed and aligned with that framework. Regulated buyers can run a private POP or virtual appliance inside their own perimeter.
Slots into the stack you already run.
Mid-Market plan, $6 per seat per month. SCIM from Entra ID / Okta / Google Workspace, HMAC webhooks, group-based rotation, MDM-pushable clients, multi-region — included.