From endpoint, browser and directory signals into one identity graph · then into risk decisions and cost decisions. The whole architecture in 30 seconds.
Three observers feed one identity graph. Two modules consume it. One policy layer runs the rules.
Each observer sees a different slice of reality. None is enough alone. Together they're a real inventory · not a guess.
A Windows endpoint agent watches what your users actually run. Optionally serves as the in-network AD reader.
A browser extension watches authenticated SaaS usage and how users sign in. It observes URL navigation events only · never page content.
An Active Directory / LDAP read-only connector runs inside your network on a managed endpoint · never as a separate connector server.
Measurable depth across the five system classes that close the loop: identity, endpoint, SaaS, AI and compliance. For each class, our scope is committed in writing.
GA = generally available · Review = store review pending · Roadmap = planned, no commitment. We don't market what we haven't shipped.
Once the inventory is real, the decisions are too. Risk, policy, lifecycle and governance run on the same source of truth.
Each SaaS is scored across three independent layers; overall risk is the highest layer. Not a black-box score · a defensible number.
Six action types from soft tuning to hard block. Enforcement happens at the endpoint · content is never stored.
Joiner-mover-leaver signals from AD. Each category ships with a concrete IT action · including a ready mailto template.
Three governance modes, six capabilities, tenant isolation. Your org's structure modelled as it is.
Four architectural commitments that show up in every deployment · not features you have to switch on.
The Active Directory / LDAP connector runs in leader mode on a managed endpoint inside your network. No separate connector server, no RSAT requirement, Kerberos pass-through by default. Multi-DC federation reads every domain controller and takes the most recent lastLogon, so the 9–14 day replication delay never lies about who's still active.
We do not sit in your traffic path. The endpoint agent runs on end-user devices only · never on production servers, databases or domain controllers. Your network topology doesn't change to deploy CenseCloud.
The browser extension uses URL navigation events only · no DOM scraping, no email parsing, no form data. OAuth tokens are encrypted with tenant-specific AES-256-GCM keys. The product is bilingual (TR + EN) end-to-end. KVKK is a dedicated risk layer with its own scoring.
Every request resolves the tenant from the auth context · never from the URL or body. Every privileged action is audited: sign-in, policy change, token revoke, enforcement, OAuth grant. Role-based access control is codified in the architecture itself.
Zero-touch MSI. Your existing MDM does the deployment. No prod-server touches, no proxy, no months-long professional services contract.
A 30-minute guided walkthrough · your inventory, your identities, your stack.
