Question 1

What is DuluthPath?

Accepted Answer

DuluthPath is an enterprise intelligence platform that integrates your disconnected data sources (SAP, CRM, Excel, APIs) into a single governed environment with AI-powered analysis, role-based access control, and compliance-ready security.

Question 2

Is there a free trial?

Accepted Answer

Yes. Every new account starts with a 3-day free trial of the Professional plan. No credit card required. At the end of the trial, you can choose a plan or continue with the free Starter tier.

Question 3

How do I create an account?

Accepted Answer

Visit duluthpath.com and click Get Started. Enter your work email, company name, and create a password. You'll receive a verification email — click the link to activate your account. If your organization uses SSO, your admin may have already provisioned your account automatically via SCIM directory sync.

Question 4

What are the system requirements?

Accepted Answer

DuluthPath runs in any modern web browser (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+). No software installation required for the cloud version. For self-hosted deployments, see the Self-Hosting section.

Question 5

How do I invite team members to my organization?

Accepted Answer

Go to Admin → Organization Settings → Members. Click Invite and enter their email addresses. You can assign roles (Admin, Manager, Analyst, Viewer) at invite time. If SSO is configured, users are automatically provisioned on first login.

Question 6

What data sources can I connect?

Accepted Answer

DuluthPath integrates with SAP, Salesforce, HubSpot CRM, Microsoft Excel/CSV files, REST APIs, databases (PostgreSQL, MySQL, MongoDB), and custom data feeds. Contact us for specific integration requests.

Question 7

What SSO providers does DuluthPath support?

Accepted Answer

DuluthPath supports SAML 2.0 and OpenID Connect (OIDC), which means it works with virtually any enterprise identity provider including Okta, Azure Active Directory (Entra ID), Google Workspace, OneLogin, PingFederate, and any SAML 2.0 or OIDC-compliant IdP.

Question 8

Is my data encrypted?

Accepted Answer

Yes. All data is encrypted in transit (TLS 1.3) and at rest. Client secrets for SSO configurations are encrypted using Fernet symmetric encryption. Self-hosted customers can use their own encryption keys.

Question 9

How do I configure SSO for my organization?

Accepted Answer

Go to Admin → SSO Settings. Choose your protocol (SAML or OIDC). For SAML: paste your IdP metadata XML and configure attribute mappings. For OIDC: enter your Client ID, Client Secret, and Discovery URL. Click Test Connection to verify before enabling.

Question 10

Can I enforce SSO for all users in my organization?

Accepted Answer

Yes. In Admin → SSO Settings, toggle Enforce SSO. This disables password login for all users in your organization. You can maintain a bypass list of emergency access emails that can still use password authentication.

Question 11

What is SCIM and does DuluthPath support it?

Accepted Answer

SCIM (System for Cross-domain Identity Management) is a standard for automated user provisioning. DuluthPath supports SCIM 2.0 (RFC 7644), which means your identity provider can automatically create, update, and deactivate user accounts when people join, change roles, or leave your organization. Supported operations: Users and Groups CRUD, PATCH updates, soft-delete, and filtering.

Question 12

How does Single Logout (SLO) work?

Accepted Answer

When a user logs out of DuluthPath, the platform sends a logout request to your identity provider, destroying the IdP session as well. This prevents the scenario where logging out of DuluthPath leaves the IdP session active. SLO is supported for both SAML (SLS endpoint) and OIDC (endsessionendpoint).

Question 13

How does DuluthPath handle session security?

Accepted Answer

Sessions use short-lived JWT access tokens with rotating refresh tokens. Admins can view all active sessions (device, IP, last activity) in Admin → SSO → Sessions tab, and revoke individual sessions or all sessions for a user. Users can view and revoke their own sessions from their Profile page.

Question 14

Does DuluthPath support multi-factor authentication?

Accepted Answer

When SSO is configured, MFA is handled by your identity provider (Okta, Azure AD, etc.). DuluthPath respects the authentication requirements set by your IdP, including MFA prompts.

Question 15

How does role-based access control (RBAC) work?

Accepted Answer

DuluthPath uses a 6-tier role hierarchy: Super Admin → Org Admin → Project Admin → Editor → Analyst → Viewer. Each role inherits permissions from the roles below it and adds its own. There are 28 granular permissions (e.g., dataset:read, pipeline:execute, settings:manage) that can be viewed and customized in Admin → Authorization.

Question 16

What is ABAC and how is it different from RBAC?

Accepted Answer

ABAC (Attribute-Based Access Control) adds context-aware policies on top of role-based permissions. While RBAC asks 'what role does this user have?', ABAC asks 'what department are they in, what classification level is this data, what time is it, and what IP are they connecting from?' DuluthPath combines both: RBAC for baseline permissions, ABAC for fine-grained contextual policies.

Question 17

Can I restrict access based on data sensitivity?

Accepted Answer

Yes. DuluthPath supports a 4-tier data classification system: Public, Internal, Confidential, and Restricted. Each user has a clearance level, and they can only access data at or below their clearance. This is enforced at the query level — restricted data never reaches unauthorized users.

Question 18

What is row-level and column-level security?

Accepted Answer

Row-level security (RLS) filters database query results so users only see records they're authorized to access. Column-level security (CLS) masks or redacts sensitive fields based on the user's role — for example, a Viewer might see j@email.com instead of the full email address, while an Admin sees the full value.

Question 19

Can I simulate access policies before deploying them?

Accepted Answer

Yes. The ABAC Admin page (/admin/abac) includes a live policy simulator. Enter a test scenario (user role, department, data classification, IP address, time of day) and see whether the policy would allow or deny access, along with which specific policy rule matched.

Question 20

How does the audit log work?

Accepted Answer

Every access decision (allow or deny) is logged with the user, resource, action, decision, matched policy, IP address, and timestamp. Admins can search, filter, and export audit logs to CSV from Admin → Authorization → Audit Log. The top-denied-access list helps identify users who may need their permissions adjusted.

Question 21

Can I create custom roles?

Accepted Answer

The 6-tier hierarchy covers most use cases, but permissions within each role can be customized. Go to Admin → Authorization to see the full permission matrix and enable or disable specific permissions per role.

Question 22

Where is my data stored?

Accepted Answer

DuluthPath supports 10 data residency regions: US-East, US-West, EU-Frankfurt, EU-Ireland, UK-London, AP-Singapore, AP-Sydney, AP-Mumbai, CA-Montreal, and SA-São Paulo. Your organization selects a region during onboarding, and all data stays within that geographic boundary.

Question 23

Can I verify where my data resides?

Accepted Answer

Yes. Go to Admin → Enterprise Ops → Data Residency to see your selected region, applicable compliance frameworks (GDPR, SOC2, HIPAA, etc.), and a residency confirmation with timestamp.

Question 24

Does DuluthPath sell or share my data?

Accepted Answer

No. DuluthPath never sells, shares, or uses your data for any purpose other than providing the service you've contracted for. Your data is your data.

Question 25

How does PII protection work in documents?

Accepted Answer

Every PDF and document exported from DuluthPath is automatically scanned for PII (email addresses, SSNs, UUIDs, user names). If PII is detected, the export is blocked by default. Org Admins can override the block with an explicit confirmation, and every override is logged in the audit trail. Document metadata is sanitized — no user data appears in PDF author, creator, or keyword fields.

Question 26

Can I export or delete all my data?

Accepted Answer

Yes. Org Admins can request a full data export from Admin → Organization Settings. For data deletion, contact support or use the self-hosted admin console's data management tools. We comply with GDPR right-to-erasure requests.

Question 27

What happens to my data if I cancel my subscription?

Accepted Answer

Your data is retained for 30 days after cancellation, during which you can export everything. After 30 days, all data is permanently deleted from our systems including backups. Self-hosted customers retain their data on their own infrastructure regardless of subscription status.

Question 28

How do I see pricing?

Accepted Answer

Pricing is available after creating a free account. Sign up at duluthpath.com — no credit card required — and pricing details will be revealed on your dashboard. This ensures we can tailor pricing information to your organization's size and region.

Question 29

What plans are available?

Accepted Answer

DuluthPath offers Starter (free), Professional, and Enterprise plans. Each tier unlocks additional features like SSO, ABAC, self-hosting, and dedicated support. See the pricing page after sign-up for full details and current pricing.

Question 30

Is there a discount for annual billing?

Accepted Answer

Yes. Annual billing saves 20% compared to monthly billing. The savings are displayed on the pricing page when you toggle between Monthly and Annual.

Question 31

How does per-seat pricing work?

Accepted Answer

Plans are priced per seat (user). You can adjust the number of seats using the slider on the pricing page to see real-time cost calculations. Seats can be added or removed at any time — charges are prorated.

Question 32

What currencies do you support?

Accepted Answer

DuluthPath supports 5 currencies: USD, EUR, GBP, CAD, and AUD. Currency is automatically selected based on your region but can be changed manually on the pricing page.

Question 33

Do you offer discounts or coupons?

Accepted Answer

Yes. Promotional coupons can be applied during checkout. Contact our sales team for volume discounts on Enterprise plans with 50+ seats.

Question 34

Will my price change if you update your plans?

Accepted Answer

No. DuluthPath uses plan grandfathering — your price at the time of subscription is locked in. If we raise prices for new customers, your existing rate is preserved.

Question 35

Can I run DuluthPath on my own servers?

Accepted Answer

Yes. DuluthPath offers a self-hosted deployment option via Docker Compose. You receive the full platform as a set of Docker images that run on any Linux server with Docker installed. Your data never touches DuluthPath's cloud infrastructure.

Question 36

What are the system requirements for self-hosting?

Accepted Answer

Minimum: 4 vCPU, 16GB RAM, 100GB SSD, Docker 24+, Ubuntu 22.04+ or any Linux with Docker support. Recommended: 8 vCPU, 32GB RAM, 200GB NVMe for production workloads with 50+ users.

Question 37

How do I install the self-hosted version?

Accepted Answer

Download the deployment package from your account dashboard. It includes a docker-compose.yml, Dockerfiles, .env.example, and a README with step-by-step instructions. Run docker compose up -d to start all services. The platform will be accessible at your configured domain within minutes.

Question 38

How does licensing work for self-hosted?

Accepted Answer

Self-hosted instances require a license key (JWT format) that specifies your plan, seat count, enabled features, and expiry date. Enter the license key in Admin → Self-Hosting. The license is validated locally — no internet connection required. A 14-day grace period is provided after expiry before features are restricted.

Question 39

How do I update my self-hosted instance?

Accepted Answer

Check Admin → Self-Hosting → Check for Updates to see if a new version is available. Updates are applied by pulling new Docker images and running docker compose up -d. A pre-update backup is recommended and can be triggered from the admin console.

Question 40

Can I run DuluthPath without internet access (air-gapped)?

Accepted Answer

Yes. The self-hosted version runs fully offline. License validation is done locally using Ed25519 cryptographic signatures. Updates in air-gapped environments are applied by transferring Docker image tarballs via secure media.

Question 41

What monitoring is available for self-hosted?

Accepted Answer

Admin → Self-Hosting shows real-time system health: service status (API, database, cache), disk usage, memory, CPU, active users, requests per hour, and error rate. You can configure alert thresholds for email/webhook notifications.

Question 42

Is telemetry sent back to DuluthPath?

Accepted Answer

Telemetry is OFF by default and fully optional. If enabled, only aggregate usage metrics are collected (total users, feature usage counts, uptime) — never customer data, query content, or PII. A telemetry manifest listing every data point is available in the admin console for your review before enabling.

Question 43

How does the multi-pass document engine work?

Accepted Answer

Documents are generated through a 4-pass pipeline: Outline (structure and sections), Content (detailed writing per section), Enrichment (data binding, charts, tables), and Validation (quality checks including minimum word counts, readability scoring, and banned-phrase detection). This ensures every document meets professional standards.

Question 44

What types of documents can DuluthPath generate?

Accepted Answer

DuluthPath includes 10 built-in professional document templates: Security Assessment, Business Case, Vendor Due Diligence, Risk Assessment, Quarterly Review, Customer Success Plan, Incident Postmortem, Compliance Policy, Executive Briefing, and Data Export. Custom templates can be created by Org Admins.

Question 45

Can I customize document branding?

Accepted Answer

Yes. Go to Admin → Document Branding to upload your organization's logo, configure footer layout, set confidentiality classification (Public, Internal, Confidential, Restricted), and toggle visibility of platform branding. White-label mode (complete removal of DuluthPath branding) is available on Enterprise plans.

Question 46

Are documents scanned for sensitive data before export?

Accepted Answer

Yes. Every document export is automatically scanned for PII (emails, SSNs, UUIDs, user names). If PII is found, the export is blocked with a clear error message. Org Admins can override with an explicit acknowledgment, and every decision is logged.

Question 47

Can I create custom document templates?

Accepted Answer

Yes. Org Admins can create custom templates via Admin → Document Branding → Templates or the API (PUT /api/admin/pdf-templates/{id}). Templates define sections, minimum word counts, required data bindings, and layout rules. Built-in templates cannot be overwritten.

Question 48

How does DuluthPath connect to my ERP?

Accepted Answer

DuluthPath uses the Meridian module to connect to ERP systems — SAP S/4HANA, Oracle ERP Cloud, NetSuite, MS Dynamics 365, and any system with OData or REST. Three connection patterns are supported: • OAuth (recommended) — one-click auth via your ERP's identity provider. Access + refresh tokens are encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256). The connector framework auto-refreshes expiring tokens and syncs every 5 minutes.
• Webhook push (no creds needed) — your ERP pushes events to a tenant-scoped endpoint (POST /api/webhooks/in/{tenanttoken}) authenticated by HMAC-SHA256 signature. Idempotent via Idempotency-Key header. Works with on-prem ERPs that can't expose OAuth.
• CSV / Excel import — drag-and-drop bulk loads through the Data Clinic for one-off backfills or air-gapped environments. For SAP specifically, DuluthPath ships a tested S/4HANA Sandbox connector — most teams are live in under 10 minutes. Larger SAP installations with custom IDocs use the webhook push pattern. Want a 15-min walkthrough? Click Ask Canaan below or reply to your activation email.

Question 49

Can I use DuluthPath alongside Salesforce?

Accepted Answer

Yes — DuluthPath sits alongside Salesforce, not in place of it. Sales teams keep working in Salesforce; DuluthPath joins your CRM data with ERP + supply chain data to surface insights neither system can see alone. Typical Salesforce integration: • OAuth connector for Sales Cloud / Service Cloud / Revenue Cloud (read-only by default, write-back optional for tasks + activity logs)
• Bi-directional account & opportunity sync — Salesforce stays the system of record; DuluthPath enriches each account with delivery performance, fill rate, churn risk score, and at-risk SKUs
• Bulk API for large data volumes (>100k accounts) — uses Salesforce Bulk API 2.0, batched + chunked, full audit trail
• Trigger automation — when a Salesforce Opportunity hits Closed-Won, DuluthPath provisions the customer in the supply chain module and emails the rep their first fill-rate snapshot The Compass module (C-Suite dashboard) is where this pays off — your CEO sees revenue (Salesforce) and fulfillment (ERP) on one screen, color-coded by tier. No more two-system PowerPoint rebuilds for Monday QBRs. Click Ask Canaan for a walkthrough of the join model.

Question 50

What changes when I add supply chain data?

Accepted Answer

Adding supply chain data unlocks the Sentinel module and transforms DuluthPath from a CRM/ERP intelligence layer into a complete operational platform. Three things change immediately: • Vendor Scorecard goes live — fill-rate, lead-time variance, OTIF, and reliability ranking per supplier. Most teams find at least one breached vendor in the first session — sometimes a $40k+/month recovery opportunity hiding in plain sight.
• Red/Yellow/Green projection heatmap — every SKU is forecasted forward and color-coded by stockout risk. Your buyer team starts every morning with a triaged list instead of a spreadsheet.
• Defer-PO recommendations — Sentinel cross-references open POs against actual demand + carrying cost, and recommends defer dates that free up working capital. The recommendations write back to your ERP (currently SAP S/4HANA Sandbox; Oracle + NetSuite in the connector roadmap). The Monday digest also gets significantly more interesting — it shifts from "here's what your sales team did" to a 5-bullet operational summary that includes vendor breaches, slow-moving inventory, and weekly margin trend. Teams typically replace 2-3 internal status meetings with this digest. Upgrade path: Sentinel is part of Growth and above. Click Ask Canaan if you want to see your fill-rate before connecting any data.

Frequently Asked Questions

Getting Started

Security & SSO

Authorization & Access Control

Data & Privacy

Pricing & Plans

Self-Hosting

Documents & Reports

Integrations

Account & Administration

Enterprise & Compliance

What's New