Visitor management your IT team operates, not a separate admin world.
The lobby becomes one more system you already run. Sign-on uses your existing IdP. Admin accounts sync from your HRIS. Visitor events flow into the SIEM your team already watches. Webhooks and a REST API cover anything off-the-shelf doesn't. Pre-built apps for Slack, Teams, Webex, Calendar, document storage, and ticketing keep your stack intact.
SSO + SCIM with the IdP you already operate.
SAML 2.0 and SCIM 2.0 are standard. Bring your own IdP if it's not on this list; custom OIDC and SAML are supported.
Okta
Standard SAML 2.0 SSO with SCIM 2.0 user-lifecycle provisioning.
Microsoft Entra ID
Enterprise SSO via SAML 2.0 with SCIM and group sync.
Google Workspace
Google SAML 2.0 with SCIM 2.0 user lifecycle.
OneLogin
SAML 2.0 SSO with SCIM 2.0 provisioning.
PingOne / Ping Identity
PingFederate-backed SAML with SCIM provisioning.
Auth0 / Okta CIC
Generic OIDC and SAML 2.0 SSO.
On-prem ADFS
On-prem Active Directory federation through ADFS.
Custom OIDC / SAML
Bring your own IdP. Generic SAML or OIDC supported.
SAML SSO ships on every plan. SCIM provisioning, on-prem AD, and HRIS sync scale with deployment depth. See pricing for the per-tier map.
Real shapes. Not "API available" with no example.
The payload your IdP sends, the event your SIEM receives, and the metadata your IdP needs to trust us. Production examples, ready to copy.
SCIM 2.0 user provisioning
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"userName": "elena.rivera@firework.com",
"name": {
"givenName": "Elena",
"familyName": "Rivera"
},
"emails": [
{ "value": "elena.rivera@firework.com", "primary": true }
],
"active": true,
"groups": [
{ "value": "site:sf-hq", "display": "San Francisco HQ" },
{ "value": "role:security-lead", "display": "Security Lead" }
]
}Webhook · watchlist match event
{
"id": "evt_4438A_2026-05-10T18:42:11Z",
"type": "visitor.watchlist_match",
"data": {
"visitor": { "id": "vis_2P39", "name": "[REDACTED]" },
"site": { "id": "site_sg_marina", "label": "Singapore · Marina office" },
"match": {
"list": "internal_blocklist",
"confidence": 0.94,
"handler": "auto_page_gsoc"
},
"host": { "id": "usr_8112", "email": "host@firework.com" },
"kiosk": { "id": "kio_03", "ip": "10.42.18.7" }
},
"delivered_at": "2026-05-10T18:42:13Z"
}SAML 2.0
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://app.visitly.io/sso/saml/acs/<tenant>">
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://app.visitly.io/sso/saml/acs/<tenant>" index="1" />
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
</SPSSODescriptor>
</EntityDescriptor>What InfoSec reviews about us as a vendor.
Helpdesk burden
Reviewer commentary on G2 and Capterra cites low training burden and quick reception adoption. Visitor management isn't a frequent IT ticket source. The kiosk is self-serve and host notification hits the channel the host already works in: Slack, Teams, SMS, or the MyVisitly app.
SOC 2 Type II
Trust badge published at every tier. Full report available under NDA via Trust Center request.
ISO 27001
ISMS certified. Statement of Applicability available under NDA via Trust Center request.
CAIQ Lite v4
Self-attestation across all 297 controls. Available under NDA via Trust Center request.
DPA + Sub-processors
DPA template published. Sub-processor list published with change-notice cadence. 72-hour breach notification.
GDPR + CCPA
Standard Contractual Clauses and privacy program data-handling commitments.
HIPAA BAA
BAA available for execution for covered-entity deployments. Encryption at rest and in transit.
What we provide as inputs to your compliance program.
Distinct from the Trust Posture above. These are documents, references, and tooling Visitly provides to support the compliance programs you own (HIPAA, ITAR, CMMC, NISPOM, OSHA, FERPA). Your auditor / C3PAO / OCR submission / counsel reviews your program; we provide visitor-side records.
NIST 800-171 Rev 2 mapping
Control-mapping reference to support your CMMC Level 2 evidence package. Available under NDA via Trust Center request. Visitly provides the mapping; your C3PAO assessor reviews your program.
ITAR, CMMC, and NISPOM evidence tooling
Visitor-side controls (citizenship gating, escort workflow, audit trail) and per-tenant evidence export feed your regulated-area program.
Audit log and retention
Configurable retention windows, audit log search and export, SIEM event streaming, and legal hold when counsel asks.
HIPAA program support
BAA executed at contract. ePHI access controls and retention configurable to HIPAA Privacy Rule. Your covered entity owns the program.
.webp)
.png){kind=logo}
live across North America, Europe, and Asia
deployment time across all locations, moved off Envoy
Skip the demo gauntlet. Pull our Trust Center and pricing yourself.
Or talk to sales. We'll route you to a human who knows multi-location enterprise deployments, not a BDR running a script.
