For your IT department
What to allow-list, how sign-in works, and what we store.
Email allow-list
Please allow mail from digest@flcourttracker.com (Friday digest, new-law alerts), noreply@flcourttracker.com (invites, password resets), and joseph@flcourttracker.com (account notices). Mail is sent through Resend with SPF, DKIM and DMARC aligned on flcourttracker.com. Our invite emails include a typed code so link-scanning security tools don't consume the one-time link.
Sign-in options
- Microsoft 365 (OAuth 2.0 / OpenID Connect). Users click Sign in with Microsoft. The app is a multitenant Entra ID registration; the first sign-in asks a tenant admin to consent to
openid, email, profile, User.Read. No passwords are stored for these users. You can pre-approve the app in the Entra admin center (Enterprise applications → Florida Court Tracker → Permissions). - SAML 2.0. We register your IdP metadata and your email domain(s). Entity ID:
https://fuwywqrnbtonawqxtktr.supabase.co/auth/v1/sso/saml/metadata. ACS:https://fuwywqrnbtonawqxtktr.supabase.co/auth/v1/sso/saml/acs. Required attribute:email. Contact us to set it up (about a day). - Email + password (12+ characters) with optional TOTP two-factor.
Session limits: each login may be active on 3 devices at once (10 for site-license firms); older sessions are revoked automatically.
Provisioning and deprovisioning
Firm admins add people by CSV (up to 2,000) in the portal. With site licensing, anyone who signs in through your SSO from your email domain is joined automatically. Removing someone in the portal ends their access immediately; disabling their account in your IdP prevents new sign-ins.
Hosting and data
Static web app on Vercel; database, authentication and APIs on Supabase (PostgreSQL, Canada Central region); email via Resend; error monitoring via Sentry. We store user email, sign-in events (IP, coarse location, user agent), and each user's saved cases, folders, tags and private notes. Case content is public court opinions and our summaries. Encryption in transit (TLS 1.2+) and at rest. See Security and the Privacy Policy.