Documentation | CodeSign Secure

Control	What it protects	Where to configure it
HSM key custody	Private keys never leave FIPS 140-2 Level 3 hardware	Keys and Certificates
Roles and permissions	What each user can see and do in the portal	Roles and Permissions
Teams and certificate mapping	Who can sign with which certificate	App Management
Environment policies and MFA	Which signing requests need human approval	Designing signing policies
Client authentication	Which machines and users can call the signing API	Client Authentication
Audit Trail and logs	Evidence of who signed what, and when	Audit Trail
Server hardening	The server, database, network and credentials	Security hardening checklist

HSM key custody

Private keys never leave FIPS 140-2 Level 3 hardware

Roles and permissions

What each user can see and do in the portal

Teams and certificate mapping

Who can sign with which certificate

Environment policies and MFA

Which signing requests need human approval