Workspace isolation
Records are scoped to a workspace owner with additional client and location boundaries enforced by the application permission layer.
Security overview
How Ultra Credentialing protects workspace access
A customer-facing overview of product security controls and their operational boundaries.
Two-step verification
Workspace policy can require email-based two-step verification, with active-session controls, backup codes and forced logout support.
Private credential files
Credential uploads are enabled only when private storage can be established outside the public WordPress web root.
Auditing
Credentialing changes, security events, file access, administrator actions, approvals and supported attestations can be reviewed and exported.
Least privilege
Granular roles can limit contracts, exports, integrations, billing, financial estimates, migration, compliance and sensitive actions.
Secure links
External provider/client workflows use time-limited revocable links rather than sharing workspace passwords.
External integrations
API keys are scoped, rate-limited and rotatable; outbound webhooks are signed with delivery health, and governed inbound sources require HMAC signatures plus replay protection. Integration secrets/logs remain excluded from portable migration packages.
Human-reviewed automation
AI and document-extraction suggestions remain non-authoritative until reviewed. Support impersonation is blocked from invoking external AI processing.
Shared responsibility
Ultra's controls support secure operation, but customers are also responsible for secure devices, user offboarding, least-privilege role assignment, approved retention, third-party configurations and appropriate handling of exported files.
Compliance positioning
Ultra provides security and compliance-support tooling. This page is not a certification, penetration-test report, SOC 2 report, HIPAA attestation or guarantee that a customer's overall environment meets a particular framework.