FOR IT & INFOSEC

Visitor management your IT team operates, not a separate admin world.

The lobby becomes one more system you already run. Sign-on uses your existing IdP. Admin accounts sync from your HRIS. Visitor events flow into the SIEM your team already watches. Webhooks and a REST API cover anything off-the-shelf doesn't. Pre-built apps for Slack, Teams, Webex, Calendar, document storage, and ticketing keep your stack intact.

Talk to IT sales

Sign-in uses your IdP

HRIS-synced identity

Events into your SIEM

Reports under NDA on request

IDENTITY PROVIDERS

SSO + SCIM with the IdP you already operate.

SAML 2.0 and SCIM 2.0 are standard. Bring your own IdP if it's not on this list; custom OIDC and SAML are supported.

Okta

Standard SAML 2.0 SSO with SCIM 2.0 user-lifecycle provisioning.

Microsoft Entra ID

Enterprise SSO via SAML 2.0 with SCIM and group sync.

Google Workspace

Google SAML 2.0 with SCIM 2.0 user lifecycle.

OneLogin

SAML 2.0 SSO with SCIM 2.0 provisioning.

PingOne / Ping Identity

PingFederate-backed SAML with SCIM provisioning.

Auth0 / Okta CIC

Generic OIDC and SAML 2.0 SSO.

On-prem ADFS

On-prem Active Directory federation through ADFS.

Custom OIDC / SAML

Bring your own IdP. Generic SAML or OIDC supported.

SAML SSO ships on every plan. SCIM provisioning, on-prem AD, and HRIS sync scale with deployment depth. See pricing for the per-tier map.

PROVISIONING + EVENTS + SSO

Real shapes. Not "API available" with no example.

The payload your IdP sends, the event your SIEM receives, and the metadata your IdP needs to trust us. Production examples, ready to copy.

SCIM 2.0 user provisioning

post

/scim/v2/Users

Copy

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "elena.rivera@firework.com",
  "name": {
    "givenName": "Elena",
    "familyName": "Rivera"
  },
  "emails": [
    { "value": "elena.rivera@firework.com", "primary": true }
  ],
  "active": true,
  "groups": [
    { "value": "site:sf-hq", "display": "San Francisco HQ" },
    { "value": "role:security-lead", "display": "Security Lead" }
  ]
}

Webhook · watchlist match event

post

your-listener.example.com/visitly

Copy

{
  "id": "evt_4438A_2026-05-10T18:42:11Z",
  "type": "visitor.watchlist_match",
  "data": {
    "visitor": { "id": "vis_2P39", "name": "[REDACTED]" },
    "site": { "id": "site_sg_marina", "label": "Singapore · Marina office" },
    "match": {
      "list": "internal_blocklist",
      "confidence": 0.94,
      "handler": "auto_page_gsoc"
    },
    "host": { "id": "usr_8112", "email": "host@firework.com" },
    "kiosk": { "id": "kio_03", "ip": "10.42.18.7" }
  },
  "delivered_at": "2026-05-10T18:42:13Z"
}

SAML 2.0

visitly-sp-metadata.xml

Copy

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://app.visitly.io/sso/saml/acs/<tenant>">
  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://app.visitly.io/sso/saml/acs/<tenant>" index="1" />
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
  </SPSSODescriptor>
</EntityDescriptor>

VENDOR RISK REVIEW · TRUST POSTURE

What InfoSec reviews about us as a vendor.

Open Trust Center

Low

Helpdesk burden

Reviewer commentary on G2 and Capterra cites low training burden and quick reception adoption. Visitor management isn't a frequent IT ticket source. The kiosk is self-serve and host notification hits the channel the host already works in: Slack, Teams, SMS, or the MyVisitly app.

Every tier

SOC 2 Type II

Trust badge published at every tier. Full report available under NDA via Trust Center request.

Every tier

ISO 27001

ISMS certified. Statement of Applicability available under NDA via Trust Center request.

Every tier

CAIQ Lite v4

Self-attestation across all 297 controls. Available under NDA via Trust Center request.

Every tier

DPA + Sub-processors

DPA template published. Sub-processor list published with change-notice cadence. 72-hour breach notification.

Every tier

GDPR + CCPA

Standard Contractual Clauses and privacy program data-handling commitments.

Every tier

HIPAA BAA

BAA available for execution for covered-entity deployments. Encryption at rest and in transit.

COMPLIANCE PROGRAM SUPPORT

What we provide as inputs to your compliance program.

Distinct from the Trust Posture above. These are documents, references, and tooling Visitly provides to support the compliance programs you own (HIPAA, ITAR, CMMC, NISPOM, OSHA, FERPA). Your auditor / C3PAO / OCR submission / counsel reviews your program; we provide visitor-side records.

Enterprise

NIST 800-171 Rev 2 mapping

Control-mapping reference to support your CMMC Level 2 evidence package. Available under NDA via Trust Center request. Visitly provides the mapping; your C3PAO assessor reviews your program.

Enterprise

ITAR, CMMC, and NISPOM evidence tooling

Visitor-side controls (citizenship gating, escort workflow, audit trail) and per-tenant evidence export feed your regulated-area program.

Business and Enterprise

Audit log and retention

Configurable retention windows, audit log search and export, SIEM event streaming, and legal hold when counsel asks.

Enterprise

HIPAA program support

BAA executed at contract. ePHI access controls and retention configurable to HIPAA Privacy Rule. Your covered entity owns the program.

sentinelone Hq

Visitor check-in powered by Visitly

"I'd highly recommend Visitly to those considering it. The system is incredibly easy to implement; our teams were up and running in less than a week."

Brent Kennedy

Director of Security Operations

7 sites

live across North America, Europe, and Asia

<1 week

deployment time across all locations, moved off Envoy

Read the SentinelOne story

TALK TO US

Skip the demo gauntlet. Pull our Trust Center and pricing yourself.

Or talk to sales. We'll route you to a human who knows multi-location enterprise deployments, not a BDR running a script.

Talk to sales

Read the Trust Center