Practices, not posture.

SCIM 2.0 provisioning and per-organization OIDC single sign-on are fail-closed: token-gated, tenant-scoped and audited, with encrypted secrets, DNS-verified email domains and existing-user-only linking — SSO cannot create an account, and a customer's identity provider cannot authenticate a Kalinklo staff account. De-provisioning is soft-only so records survive. Honest boundary: we switch these on only for an approved enterprise customer, after testing the full sign-in lifecycle with that customer's own identity provider; they are not generally available.

Kalinklo is private by default. A new account opens no dashboard until it is approved. Applications are screened, and any with warning signs always wait for a person on our team; an organization can also approve the people it invites with its own access code. There is no path to dashboard data that bypasses approval.

Public pages never show a real organization's, member's, agency's, presenter's, document's, or engagement's private records. The public artist directory shows only sample profiles, and a real artist's profile opens only for signed-in, approved Kalinklo accounts. The one thing an artist can choose to share publicly is an availability link showing their name and which dates are taken — at the Public level only.

By default an artist account sees only its own profile, availability, requests, holds, quotes, contracts, invoices, documents, and the agencies/presenters connected to engagements it participates in. There is no general browse-all-artists directory inside the platform for artist-role users.

Roster operations belong to the agency workspace. Access to shared engagements and artist discovery follows the participant, role and visibility rules; workspace membership alone does not grant access to another agency's private operations.

An organization workspace sees only its own productions, schedules, assignments, member access, documents, announcements, acknowledgements, engagements, requests, contracts, invoices, and settlement records. Where the plan includes artist discovery, it shows only verified artists at the Public or Private listing level; otherwise no cross-workspace visibility exists.

Public (the profile opens to signed-in, approved Kalinklo accounts and appears in their search; the artist may also share a free/busy availability link) · Private listing (the default for every new artist: the same accounts can open the profile and send requests, with no public availability link) · Stealth (visible only to the artist's Agency OS workspace and explicitly invited presenters) · Workspace-private (the profile and its engagements stay inside the artist's own workspace). At no level does a real artist's profile open to anonymous visitors or search engines.

No counterparty-facing message, contract, invoice, or settlement change moves without a person confirming the exact action. The approval itself is audited — who clicked, when, and on which payload.

Engagement workflows record audit events for actions such as requests, holds, contracts and invoices. Event detail and visibility depend on the workflow and your access. Request current control evidence for your institution's review.

Protected records use workspace and role checks. Detail routes can conceal inaccessible records with a 404; other permission denials can use 403 or an access screen. Shared engagement access and verified artist discovery follow their own visibility rules.

Scores, parts, contracts, and internal documents never use permanent public links. Library Desk records rights status, approval state, expiry, acknowledgements, and access events before a member can view or download material.

Kalinklo may suspend workspaces used for harassment, fraud, scraping, false rights claims, credential sharing, unauthorized document redistribution, or attempts to bypass workspace boundaries.

Public status routes can expose service readiness information, not private business records. Administrative operations require authorized access and the applicable MFA gate.

The Content Security Policy restricts script and connection sources and prevents framing. Inline scripts and styles remain a documented limitation. Vercel Analytics and Speed Insights are conditional on configuration; see the privacy notice for data handling.

Public support requests have an IP-based limit; hold requests require an approved account and a per-account limit. Failed sign-in attempts are throttled and logged. Limits differ by route.