RHi @Mahith! Thanks for reaching out. :gigipixel: Here's a link to our trust center with extensive info on our compliance - You can learn more about our security posture and request access to our security documentation here 
https://trust.zitadel.com/
Our suggestion here would likely be to use refresh tokens instead but I'll loop in @fabienne or @FFO to give you more technical insight on this (and your additional questions) based on your use case.
https://trust.zitadel.com/Our suggestion here would likely be to use refresh tokens instead but I'll loop in @fabienne or @FFO to give you more technical insight on this (and your additional questions) based on your use case.
Welcome to ZITADEL's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
For security reports, please consult our security.txt how to get in touch and report vulnerabilities.
Useful resour...
For security reports, please consult our security.txt how to get in touch and report vulnerabilities.
Useful resour...
F- At the moment it is not possible to have a PAT for human user, only for service users, you could implement a token exchange flow, to do requests on behalf of the human user as a machine user
F- We do not yet have SOC2, but we are in the process of getting it, will land around mid year
F- last login is currently not available on the user list, a possibility would be to search the events for this. in that case you get a list of logins with the user ids, and would need to search for the users separately, So at the moment it is not possile within one call
F- this is the request we run from the console: https://zitadel.com/docs/apis/resources/mgmt/management-service-list-user-changes
Returns a list of changes/events that have happened on the user. It's the history of the user. Make sure to send a limit.
F- I think this is not possible, but I am not sure on this topic. @adlerhurst or @muhlemmer might be able to help
F- you can read about our disclosure process here: https://zitadel.com/docs/legal/policies/vulnerability-disclosure-policy#disclosure-process
A- No there isn’t, Zitadel normally gets its own database (inside your dbms), this gives you more flexibility for configuration purposes
FAt the moment token exchange / impersonation in Zitadel is implemented in a way that both users need to exist in Zitadel. We can't exchange external tokens. But from what i understand that would be the case for you, its just not a user in the organization of the customer
FThe Token Exchange grant implements RFC 8693, OAuth 2.0 Token Exchange and can be used to exchange tokens to a different scope, audience or subject. Changing the subject of an authenticated token is called impersonation or delegation. This guide will explain how token exchange is implemented inside ZITADEL and gives some usage examples.
MAny update on SOC2?
FYes, we are actually in the SOC 2 observation phase, which goes until end of August. So there is active work here 