Access Controls

Sign-in, permission and incident controls you can check.

Resolion has not been through a SOC 2 audit. These are the access and change controls the platform enforces today, each one leaving a record behind it.

Lockouts that survive a restart

LoginGuard counts failed sign-ins from the login_attempt table, not memory, so an account lock, and the trail behind it, can't be reset by a deploy or waited out.

Every RBAC change attributed

RoleAdminService logs the actor behind every permission grant or revoke, with the before-and-after state; the access-control evidence an auditor asks for first.

Incidents that don't vanish once fixed

AlertEvaluator opens an incident only after repeated bad samples, not the first blip, and keeps the row after it resolves, "was this monitored" gets an answer with a timestamp.