Single sign-on (SSO) across Digital Empire products, explained

Every Digital Empire product (PixelProof, EntryProof, TariffWatch) currently ships its own login. There is no unified cross-product SSO in production today. This article explains why that is, what has shipped at the portfolio identity layer that makes a future unified sign-in possible, and what the near-term seat roadmap looks like.

Where auth lives today

Each product has its own account page and its own login form. PixelProof accounts live at /meta-monitor/account, EntryProof at /cpsc-efile/account, and TariffWatch at /tariffwatch/account. Signing into one does not sign you into the other two. If you buy all three products (individually or through the Founding Trio bundle), you receive three separate account credentials tied to the same email address.

This is not the target state, but it is the shipped state. Cross-product SSO is a real infrastructure project, not a config toggle, and shipping it before the portfolio identity table existed would have been premature.

What the portfolio identity table changed

The Foxtrot7 ship on Aug 20 2026 introduced a shared empire.customers table at the portfolio level. This table is a single row per real human, keyed by email, that stores which of the three products the customer has purchased and at what tier. Reference on the roadmap page: the portfolio-level surface section at /roadmap lists this table as a shipped item.

The immediate consequence: your billing across products, referral rewards through Rewardful, and support-ticket history are now reconciled to a single portfolio identity even though the three product logins remain separate. The eventual consequence (once the per-product login surfaces read from this table on signup rather than each holding their own user record) is one login for all three products.

What "same email equals same person" means in practice

Today, if you sign up for PixelProof and then later sign up for TariffWatch using the same email, the two accounts are logically linked at the portfolio identity layer even though the login credentials are separate. Support requests reference your full product footprint, billing is unified, and if you cancel one product the other two are untouched. The billing across products KB article covers the invoice mechanics.

Access to each product is scoped to the product. Being signed into PixelProof does not grant read access to TariffWatch data, and vice versa. This matches the security model documented in the security page at /security.

The M2 Agency plan roadmap

The near-term seat-and-SSO roadmap ships alongside the M2 Agency plan, targeted for October 2026 per the adding a teammate KB article. The Agency plan brings three changes: one billing owner with up to five teammate seats, per-seat login (each teammate has their own credentials, own email for alerts, own permission tier), and unified authentication across the product suite so that one sign-in surface covers all three products for an Agency-plan account.

The Agency-plan launch does not automatically retrofit single-seat accounts. Existing single-seat customers keep their per-product logins until they upgrade to the Agency plan. Founding Trio customers who purchased the three-product bundle receive a grandfathered Agency-plan price when the plan launches, per the founding-cohort commitment at /founding-trio.

Enterprise SAML SSO

SAML-based enterprise SSO (integration with Okta, Google Workspace, Microsoft Entra ID, and similar identity providers) is a separate roadmap item that follows the Agency-plan seat work. The SOC 2 Type II audit targeted for 2027-Q2 is a prerequisite most enterprise SSO buyers ask for before enabling SAML federation, so the sequencing is deliberate. On the technical side, the browser cookie mechanics SAML federation depends on are standardized in RFC 6265 on rfc-editor.org, and the JSON-LD identity structures our portfolio pages already publish follow the schema.org Person type.

Adding a teammate today

Before Agency-plan seats ship, the current workarounds (shared alert webhooks, shared account credentials for actual editors) are detailed in the adding a teammate KB article. That article also covers preparation steps you can take today to make the eventual Agency-plan migration painless.

For CCPA-covered California customers, the shared-credential workaround is compatible with the enforcement guidance published at oag.ca.gov CCPA, because a shared employer-provided credential is treated as a single business-account context rather than as consumer identity theft.

Was this helpful?

Yes / No

Related articles

Adding a teammate to your Digital Empire account

Billing across Digital Empire products

How to cancel your subscription

Digital Empire roadmap

FAQ

Can I log into PixelProof and see my TariffWatch alerts? Not today. The three products have separate logins. Portfolio identity is reconciled at the billing and support layer only.

When does unified sign-in ship? Alongside the M2 Agency plan targeted for October 2026. Enterprise SAML SSO ships after that, gated on the SOC 2 Type II audit in 2027-Q2.

Do I get charged separately for each product? Yes, until the Agency plan launches. Founding Trio bundle customers pay a single annual invoice for all three products, but the underlying auth is still per-product.

Still stuck? Email hello@citationsafe.com or hello@argushq.ai.

FAQ

Can I log into PixelProof and see my TariffWatch alerts?

Not today. The three products have separate logins. Portfolio identity is reconciled at the billing and support layer only.

When does unified sign-in ship?

Alongside the M2 Agency plan targeted for October 2026. Enterprise SAML SSO ships after that, gated on the SOC 2 Type II audit in 2027-Q2.

Do I get charged separately for each product?

Yes, until the Agency plan launches. Founding Trio bundle customers pay a single annual invoice for all three products, but the underlying auth is still per-product.