Overview
CX Platform is built to play nicely with the security setup you already have. Whether your organisation runs on SAML2, OAuth2, or a mix of both, you can plug CX Platform into your identity provider and let your existing controls do the heavy lifting.
The platform supports a layered approach to authentication — single sign-on for everyday access, multi-factor for the extra protection, and built-in password authentication when you need a standalone option. On top of that, every API connection is TLS-encrypted, and the platform itself is ISO27001 certified.
This guide covers the authentication methods available to you, the security and compliance standards CX Platform aligns with, and the best-practice principles baked into how it all works.
Good to know
You don't need to pick just one method. Most customers combine SSO for daily logins with MFA for sensitive actions, and use password authentication as a fallback for users who sit outside the corporate directory.
Authentication methods
Here's a rundown of the three authentication methods CX Platform supports, and when each one comes into play.
| Method |
What it does |
| Single Sign-On (SSO) |
Lets your users sign in to CX Platform using the same credentials they already use everywhere else. Once you've connected your identity provider, there's no separate password for the platform to remember (or reset).
- Protocols supported — SAML2, OAuth2, and OpenID Connect, so you can federate with all the major identity providers and directory services.
- Works across modules — one login covers every Chandler module the user has access to.
- Best for — organisations with an existing IdP who want a single set of credentials and centralised access control.
|
| Two-Factor Authentication (2FA) |
Adds a second check to the non-SSO login process, so a password alone isn't enough to get in. Users confirm their identity with a unique one-time-PIN OTP via SMS.
- Available for everyone — both platform admins and end user sare enrolled in 2FA as part of the secure login workflow.
- Best for — protecting admin accounts, sensitive content, or any workflow where an extra check is worth the few seconds it adds.
|
| Password authentication |
The built-in option — username and password, with configurable complexity rules so you can match your organisation's password policy.
- Fully configurable — set the minimum length, character requirements, and expiry rules that suit your security posture.
- Stands alone or combines — works on its own, or alongside MFA for extra protection.
- Best for — users outside your corporate directory, or when you need a self-contained login that doesn't depend on an external IdP.
|
Security and compliance standards
Authentication is only part of the picture. The protocols, certifications, and API protections behind the scenes are what make the whole thing trustworthy. Here's what CX Platform brings to the table.
| Standard |
What it covers |
| Industry certifications |
CX Platform is ISO27001 certified, which means the platform has been independently assessed against the global standard for information security management. It also supports strong identity verification in line with government and banking sector requirements, including Know Your Customer (KYC).
|
| Authentication protocols |
- SAML2 — for federated single sign-on with enterprise identity providers.
- OAuth2 and OpenID Connect — for modern, scalable integrations with cloud services and APIs.
- One-Time Passwords (OTPs) and 2FA — built into secure login flows where an extra factor is needed.
|
| Secure API integrations |
Every connection to the Admin and Verification APIs is protected with TLS encryption, so data in transit stays private whether you're authenticating an end user or syncing with another system.
|
| Regulatory alignment |
CX Platform is designed to align with the Consumer Data Right (CDR) regime and Australian privacy and security legislation covering digital customer authentication and consent management. That means the tooling you need to capture consent, verify identity, and keep records is built in — not bolted on.
|
| Best-practice principles |
The platform follows current best practices for risk-based fraud detection, accessibility, and defensible audit trails. In plain English: it's set up to spot suspicious activity, work for everyone, and give you the records you'd need if anyone ever asked questions later.
|
What's next
Now that you've got a handle on what's supported, your next step depends on how you want to set things up. If you're configuring SSO with your identity provider, head to the SSO setup guide. If you're enrolling users in MFA, the secure login workflow article will walk you through it. And if you need to fine-tune password rules, those live in the platform security settings.
