Security
Security model
How StageReady protects client credentials and one-time codes.
Where a secret can live
Only one of these layers ever holds a credential, and it isn't the one a technician carries around in their bag.
A boot environment and a code prompt. No passwords, no client names, no logic.
Stores a hash of each code and the name of a vault secret, never the secret itself.
Client credentials live here alone, read for the moment a job needs them.
The 6-digit code
Each provisioning code is single-use and short-lived. Only a hash of the code is ever stored, never the code itself, so even a database leak reveals no usable codes. Repeated wrong attempts invalidate it.
Client credentials
Credentials for a client's Microsoft environment are stored only in Azure Key Vault. They are never placed in our database, in configuration, on the USB, or on the device. The application can only read them, for the moment a job needs them.
Sign-in and offboarding
Technicians authenticate with their Microsoft 365 work account. When you disable a departed employee in your own tenant, they lose access to StageReady automatically, within the hour. An administrator can also revoke access instantly.
Offboarding is one action, not two
Because identity lives in your Microsoft tenant, there's no separate StageReady account to remember to disable when someone leaves.
Access isolation
Access is scoped per technician and per client: a technician only sees the clients they're assigned to. Every action is written to a permanent audit trail.
A lost USB
Nothing happens. The stick contains no passwords, no client information, and no logic. It is just a boot prompt asking for a code. See data residency and GDPR for how the rest of your data is handled.