Security Overview
Vince Platform is a serverless SaaS application designed for secure, scalable cloud-based workflow execution. VXL Live is its Excel Add-in component. Both are built for enterprise environments and meet the expectations of security-conscious IT teams.
This page covers the security architecture, authentication model, data protection controls, network requirements, M3 integration security, and the access control system.
Shared responsibility model
Vince Platform follows the shared responsibility model:
| Vince is responsible for | You are responsible for |
|---|---|
| Platform infrastructure and runtime security | Configuring user accounts and access controls |
| Encryption key management | Managing your identity provider integration |
| Platform-level security controls and patches | Defining what data enters and exits via connections and workflows |
| Availability and uptime | Enforcing MFA and SSO policies through your IdP |
Understanding this boundary helps you assess what you own and what Vince manages on your behalf.
Authentication and authorisation
Multi-factor authentication (MFA)
Vince Platform supports strong authentication with MFA. When SSO is configured, MFA enforcement is delegated to your identity provider — configure MFA requirements there to apply them to all Vince Platform users. For users who sign in with email and password, Vince Platform also supports SMS verification codes — see Signing in.
Single Sign-On (SSO)
Vince Platform integrates with any OIDC-compliant identity provider. Supported examples include:
- Microsoft 365 / Entra ID (Azure AD)
- Okta
- Ping
Vince Platform supports OIDC only. SAML is not supported.
SSO can be optionally enforced tenant-wide, preventing users from signing in with a username and password. See Single Sign-On.
API clients (OAuth 2.0)
Machine-to-machine integrations use OAuth 2.0 client credentials. Each API client has its own Client ID and Secret and is scoped to one or more roles. See API Clients.
Data encryption
At rest
| Property | Detail |
|---|---|
| Algorithm | AES-256 |
| Key management | Customer-specific keys where possible |
| Key storage | FIPS 140-2 compliant Hardware Security Modules (HSM) |
In transit
All data in transit uses TLS 1.2 or later. Earlier TLS versions are not supported. This applies to all browser connections, WebSocket connections, and API traffic.
Network requirements
Firewalls, proxies, and content filters in your network must allow outbound HTTPS and WSS traffic to the following domains on port 443.
Production
| Protocol | Domain | Port |
|---|---|---|
| HTTPS | *.vince.live | 443 |
| WSS | graphql.vince.live | 443 |
Development and staging
| Protocol | Domain | Port |
|---|---|---|
| HTTPS | *.dev.vincelive.dev | 443 |
| WSS | graphql.dev.vincelive.dev | 443 |
| HTTPS | *.staging.vincelive.dev | 443 |
| WSS | graphql.staging.vincelive.dev | 443 |
WSS (WebSocket Secure) is required for real-time features — there is no long-polling fallback.
These requirements apply to both the browser-based platform and the VXL Live Excel Add-in. If users run VXL Live on managed devices behind a corporate proxy or firewall, ensure the domains above are whitelisted.
M3 integration and user permissions
Vince Platform connects to Infor M3 via the Infor ION API Gateway, using a service account with "run as" capability — a standard M3 CE feature.
M3 User ID tagging
Each Vince Platform user can be tagged with their M3 User ID. When a tag is present:
- Every M3 API transaction runs under that user's ID
- M3-level access control is fully respected — the workflow cannot access data the tagged user cannot see
If no M3 User ID is tagged on a user, the ION API Gateway service account is used as a fallback. This is appropriate for automated, non-interactive workflows that do not act on behalf of a specific user.
Add M3 User ID tags to individual accounts in Administration → Access Management → Users.
Automating M3 User ID assignment
M3 User IDs can be kept in sync automatically. A workflow can read user emails and M3 User IDs from Microsoft Graph API or the Infor IFS API, then update Vince Platform users via the Users API. Contact Vince for assistance setting this up.
VXL Live security
VXL Live is an embedded version of Vince Platform running inside Microsoft Excel. It applies identical security controls:
- The same authentication and authorisation as the browser platform
- TLS 1.2+ encryption for all traffic
- The same network requirements (see domains above)
VXL Live communicates exclusively with Vince Platform. It does not connect directly to M3, Azure, or any other external service — all external system interactions go through Vince Platform's connection layer.
VXL Live updates automatically. No redeployment is required when Vince releases a new version — every time a user opens Excel, the latest version is loaded.
→ VXL Live
Access control (RBAC / ABAC)
Vince Platform uses role-based access control (RBAC) with attribute-based policies for fine-grained permission management.
| Account type | Default access |
|---|---|
| Admin | Unrestricted access to all platform features |
| User | No access by default — permissions must be granted through roles |
How permission rules work
Each rule in a role is defined by four parameters:
| Parameter | What it selects |
|---|---|
| App | The application scope: Foundation (core platform) or a specific Custom Table |
| Resource | The resource type within that app |
| Resource Name | A specific named item, or * for all items of that resource type |
| Action | * (full access), Read (view only), or Write (create and modify) |
Controllable resources
| Resource | What it covers |
|---|---|
| Connections | Connections to external systems |
| Environment | Workflow environments |
| Groups | Workflow group definitions |
| API Clients | API client registrations |
| Dashboard | Dashboards and widgets |
| Users | User account management |
| Roles | Role definitions |
| Gateway | Gateway configuration |
| Metadata | Workflow metadata |
| Variable | Tenant-level variables |
| Webhook | Webhook definitions |
| Workflow | Workflow definitions |
| Custom Table → Data | Data rows within a custom table |
| Custom Table → Configuration | Schema and settings of a custom table |
Example permission rules
- Grant access to all connections: App = Foundation, Resource = Connections, Resource Name =
*, Action =* - Grant read-only access to one workflow: App = Foundation, Resource = Workflow, Resource Name =
<workflow name>, Action = Read - Allow a team to see their group's workflows in VXL Live: App = Foundation, Resource = Groups, Resource Name =
<group name>, Action = Read
→ Roles — create and assign roles
FAQ
Can Vince Platform be installed on-premises or self-hosted?
No. Vince Platform is only available as a service hosted by Vince. There is no on-premises or self-hosted installation.
Which identity providers are supported for SSO?
All OIDC-compliant providers — including Microsoft 365 / Entra ID (Azure AD), Okta, Ping, and Google.
Is SAML supported?
No. Vince Platform supports OIDC only.
How are M3 User IDs handled when calling M3 APIs?
The ION API Gateway service account has "run as" permission. When a Vince Platform user has an M3 User ID tag, every M3 API call from that session uses their ID and respects their M3 permissions. Without a tag, the service account is the fallback.
Can M3 User IDs be synchronised automatically?
Yes. A workflow can read user data from Microsoft Graph API or Infor IFS API and update Vince Platform users via API. Contact Vince for assistance.
Do I need to redeploy VXL Live for every new version?
No. VXL Live updates automatically — every time a user opens Excel, the latest version loads. No action is required from you or your users, even for frequent updates.
How do I deploy VXL Live across my organisation?
See the VXL Live installation guide for deployment options including standard deployment and SharePoint integration.
Further reading
- Single Sign-On — configure and enforce SSO
- SCIM — automate user provisioning from your identity provider
- Roles — create and assign permission sets
- Connections — manage authenticated connections to external systems
- VXL Live Installation — deploy the Excel Add-in