Contents

Govern

Administration

Admin is for admins only.

Users and roles

  • Add people before they sign in. Their email must be on one of your organisation's sign-in domains. They're linked to their identity at first sign-in.
  • Change roles, disable and re-enable, and remove people. Disabling or removing someone ends their sessions at once, and stops their AI assistant tokens and connected apps.
  • You can't change your own role, disable or remove yourself, and the organisation always keeps at least one active admin.
  • Role changes, additions and removals are audited, by ID; names and emails never go into the log.

See Getting started for what each role can do.

Single sign-on

Everyone signs in through your identity provider over OpenID Connect (Okta, Microsoft Entra ID, Google Workspace and others). Valitura connects your identity provider when your organisation is set up. Under Single sign-on you can see the settings and set Create unknown users on first sign-in as to a role, or to Don't create (admins add users). Changes to the issuer, client or domains are made by Valitura after verifying that you own the domain. New people never join as admins, and personal email domains (gmail.com, outlook.com and the like) can never join this way.

Data subject requests

When someone asks what data you hold about them, to take it with them, or to erase it, Admin → Data subject requests finds everything Akesis holds about one person in your organisation. Search by email address or code-host login. It looks at:

  • their account, sessions, assistant tokens and connected apps;
  • audit entries they made, and entries whose details mention them;
  • risk acceptances, disputes and narratives linked to them;
  • the Jira connection's email;
  • pull-request author logins;
  • scanner text that mentions them.

Download export (JSON) gives you the records for an access or portability request. For erasure, each result says what to do. Usually that's removing the user under Users, since entries they made in the audit log name only an internal ID. Entries that mention them (in a reason or a note, say) can be erased with Erase … entries mentioning them, after a confirmation. That removes who, where and the details for good, keeps what happened and when, and the audit log still verifies. Entries written before Akesis could erase them stay until offboarding or the end of the retention period. Searches and exports are recorded in the audit log without the search term.

Leaving Akesis

To leave, contact Valitura. Offboarding happens in two steps:

  1. Access and export. Everyone's access is cut at once, every integration is disconnected so nothing more runs, and you receive a full export: every finding, repository, policy, risk acceptance, ticket link and narrative, plus the full audit log with what's needed to verify it. Credentials and secret references are left out.
  2. Deletion, within 30 days. Once you've confirmed the export, all your data is deleted. The audit log is then anonymized: who did something and in which repository are erased, while what happened and when are kept, still verifiable, for seven years, then deleted. A record that the deletion happened is kept.

You'll also need to remove what Akesis can't remove on your side: the GitHub App installation, Bitbucket and GitLab webhooks and tokens, the Jira API token and the Slack webhook.