Security center
Under Security → Security center you see and control everything security-related: who's signed in, alerts to Teams, maintenance and GDPR requests. The rules live in the database itself, not just in the screen.
| Tab | What you see | For whom |
|---|---|---|
| Log | Sign-ins, new devices, revoked sessions, Graph permissions, GDPR exports, blocked scripts, maintenance | Administrators |
| Sessions | Every session per person and device; revoke one or all | Everyone (own), administrators (all) |
| Graph permissions | Per client which permissions the app really had at the last test | Everyone |
| Alerts | Teams or your own webhook, which events, test alert | Administrators |
| Maintenance | Notice in the app, booking page and portal; block self-scheduling | Administrators |
Revoking sessions
Every sign-in is a session. When you revoke a session, it immediately loses all access to data, even if its token is still valid and even after refreshing it.
Scroll here or press play.
Do three things: revoke all sessions, remove the team member from the team, and block the account in Entra. That last one is the real door: without an Entra account nobody can sign in again.
Alerts to Teams
Rollout sends alerts from the database. The webhook URL is stored in a table no user can read; after saving you only see its beginning.
- Create a webhook in Teams
In the channel: Workflows → "Post to a channel when a webhook request is received" → copy the URL.
- Save it in Rollout
Security center → Alerts → paste the URL, choose the events and click Test alert. It should appear in the channel within a few seconds.
- Choose what you want to hear about
Sign-in on a new device, sessions revoked, excessive Graph permissions, a client connection failing, a blocked script (CSP), GDPR erasure, maintenance on/off, one-click fix, and a daily digest of employees with an appointment tomorrow who aren't ready yet.
Requirement: the pg_net extension is on in Supabase (Database → Extensions). At most 30 alerts per hour per organization; every attempt is listed under Sent alerts.
Watching Graph permissions
At every connection test Rollout checks which permissions are in the token. Anything that can write, send mail, manage roles or read secrets makes the test fail. Broader read permissions (like Directory.Read.All) give a warning. So you see it right away if someone gives the app registration too many permissions.
Maintenance
Two modes:
| Maintenance notice | Hard maintenance mode | |
|---|---|---|
| Where | Security center → Maintenance | Environment variable MAINTENANCE_MODE=on + redeploy |
| Effect | Notice in the app, on the booking page and portal; optionally block self-scheduling | Everything closed: every page shows a maintenance page, every API returns 503 |
| When | Planned work, the app stays usable | Big updates, incidents, or when the database itself is down |
In hard mode, /api/health and /api/ready keep working. With MAINTENANCE_BYPASS_IPS you can still get in yourself to test.
GDPR: access and erasure
On an employee's page an administrator can:
- Export: all data as JSON, for an access request (Art. 15).
- Erase: with a mandatory reason and typing the name. Appointments, invitations, readiness and feedback are deleted; laptops stay but are unlinked.
Both actions are recorded with a reference, without the name. Existing audit log lines stay (it's tamper-evident) and disappear with the retention period.