Last verified: 2026-07-27 · Disclosure
⚠️ Compliance certifications and security features change, and every vendor's marketing page overstates. Nothing here is a substitute for a security review. Get claims in writing, on a signed document, from the vendor — including from us.
The dimension most teams skip during evaluation and most regret skipping. Two things matter and they pull against each other: how granular the model is, and whether it's legible enough that people configure it correctly.
A permission model nobody understands is a permission model configured wrong. The most common real-world security failure in these tools is not a vendor breach — it's a document shared more widely than intended, by someone who didn't understand the sharing UI.
That gives you a genuine trade-off:
Granular models (Jira, ClickUp) can express any policy and require an administrator to maintain. Left unmaintained they drift, and drift in a granular system is worse than coarseness because it's invisible.
Coarse models (Linear, Basecamp) can't express fine policy and can't be misconfigured into a surprise. Linear's workspace-and-team model is deliberately simple; it has no answer for "this contractor sees exactly these three projects."
Derived models (Macro) compute access from behavior rather than administration — mentioning something in a channel grants that channel access to it, joining grants, leaving revokes. Eliminates the permission-request round-trip and is coarser than an ACL. We build this; the honest limitation is that fine-grained per-document control is weaker than a scheme-based system.
There's no correct answer. Match the model to whether you'll actually have an administrator.
Single sign-on is a baseline security control. It is also, across most of this category, gated behind a tier costing 2–3× the entry price.
Enterprise-only, verified 2026-07-27: Linear (SAML on Enterprise; lower tiers get Google only), Asana (SAML on Enterprise; Advanced gets Google), ClickUp (SAML and SCIM on Enterprise; Business gets Google), Attio (SSO and SCIM on Enterprise only), Monday (Enterprise).
Gated one tier up: Notion (SAML at Business, $20/seat), Airtable (Business).
Included broadly: Macro, Basecamp (all plans).
Better than assumed: Slack includes SAML SSO and SCIM on Pro at $7.25/seat. Slack is often cited as an SSO-tax offender and, as of this verification, it isn't one. Linear, Asana, ClickUp, and Attio all gate SAML higher than Slack does.
The practical effect is that many small teams who should have SSO don't, because it doubles their bill. If you have a compliance requirement, price the SSO tier — that's your real number, and it changes the pricing comparison substantially.
SCIM provisioning is usually gated one tier higher still. Ask about it separately; "SSO" in marketing copy frequently means SAML login without automated deprovisioning, and deprovisioning is the half that matters when someone leaves.
| Tool | Granularity | SSO tier | Audit log | Self-host | Score |
|---|---|---|---|---|---|
| Jira | Project, issue, field level | Guard (add-on) | Full | Data Center | 5 |
| ClickUp | Granular + custom roles + guest field controls | Business+ | Yes | No | 4 |
| Slack | Channel, workspace, Enterprise Grid | Business+ | Yes | No | 4 |
| Attio | Object and record level | Higher tiers | Yes | No | 4 |
| HubSpot | Strong on Enterprise, weaker below | Higher tiers | Enterprise | No | 4 |
| Asana | Project and team level | Advanced+ | Higher tiers | No | 4 |
| Monday | Board level; good controls on Enterprise | Enterprise | Enterprise | No | 4 |
| Macro | Channel-derived, workspace | Included | Yes | AGPLv3 | 4 |
| Linear | Workspace and team — deliberately coarse | Higher tiers | Limited | No | 3 |
| Notion | Page level | Business+ | Enterprise | No | 3 |
| Airtable | Base and table; field control on Business | Business+ | Higher tiers | No | 3 |
| Coda | Doc level — coarse inside a doc | Enterprise | Enterprise | No | 3 |
| Superhuman | Inherits your mail provider | Via provider | Via provider | No | 3 |
| Basecamp | Project level + Clientside | Included | Limited | No | 2 |
| Obsidian | None | N/A | No | Local files | 1 |
Obsidian's 1 is not a criticism — it's a single-user tool with no permission model by design, which is why it's disqualified from team use throughout this repo. Its local-file architecture is genuinely the strongest data-control posture here for an individual.
Coda's doc-level model is the one most likely to surprise you. Complex work concentrates into large docs, and "share this one section with the client" means restructuring the doc. Check this against your use case before committing.
Linear's 3 is a deliberate product decision. Granular permissions are a major source of the complexity Linear avoids, and the simplicity is why it scores 5 on setup. It's still a hard blocker for agencies, contractor-heavy teams, and regulated environments.
SOC 2 Type II is the common baseline and most established vendors here have it. ISO 27001, HIPAA (with a BAA), and GDPR/data-residency commitments vary considerably.
Verify directly rather than trusting any comparison table, including this one. Certifications lapse, scopes differ, and "SOC 2" on a marketing page can mean Type I, an in-progress audit, or a report covering a subset of the product. Ask for the actual report under NDA. A vendor that won't share one is telling you something.
This applies to us too. Ask us for the same documentation you'd ask any other vendor for, and get the answer in writing.
- What tier do I need for SSO, and does it include SCIM deprovisioning? These are frequently different tiers and only one of them protects you when someone leaves.
- Can I see who accessed what? Audit logging is commonly Enterprise-only, and you need it after an incident, not before.
- What happens to data on offboarding? Retention, deletion guarantees, and whether departed users' content is recoverable.
- Where is data stored, and can I pin the region? Frequently an enterprise-only control and frequently a hard legal requirement in the EU.
- How do agents authenticate? As a user with that user's permissions, or as a workspace-level bot that can read everything? See API, MCP & extensibility — this is the emerging gap and most vendors currently get it wrong.
- Ask for the SOC 2 report. Not the badge. The report.