Ship faster together — without loosening controls.
Ark8's enterprise layer brings SSO, RBAC, and audit into a native macOS product without asking your engineers to compromise on how they actually work.
Single Sign-On
Google Workspace and Microsoft Entra ID today. Generic OIDC and SAML on the roadmap.
RBAC
Four scoped roles — Owner, Admin, Member, Viewer — enforced by Postgres RLS.
Audit
Append-only audit log with automatic secret redaction at write time.
Local-first
Team sharing publishes descriptors only. Credentials never leave the device.
Organization model
Tenants, memberships, groups — from Postgres up.
Every user belongs to zero or more organizations through explicit memberships. Groups let admins assign roles at scale without touching individual users.
- One user, many organizations — an active membership per tenant, each with its own role.
- Groups can hold Admin / Member / Viewer — never Owner (enforced at the database).
- Cross-tenant isolation is a Postgres invariant, not a UI concern.
Single Sign-On
PKCE-based OIDC — no secrets in the app.
Google Workspace and Microsoft Entra ID sign-in ship today. All provider secrets live in Supabase Auth — the macOS application only speaks PKCE. Additional OIDC / SAML providers are on the roadmap.
Auditability
Compliance ready — without asking your team to change how they work.
Every membership change, every share, every admin override lands in an append-only log with secrets automatically redacted at insert time. UPDATE and DELETE on the audit table are blocked by database trigger.
Rolling Ark8 out across your org?
We work directly with platform and infrastructure teams to make the enterprise onboarding painless — from SSO configuration to audit-log integration.