Question 1

What is DuluthPath?

Accepted Answer

DuluthPath is an enterprise intelligence platform that integrates your disconnected data sources (SAP, CRM, Excel, APIs) into a single governed environment with AI-powered analysis, role-based access control, and compliance-ready security.

Question 2

Is there a free trial?

Accepted Answer

Yes. Every new account starts with a 3-day free trial of the Professional plan. No credit card required. At the end of the trial, you can choose a plan or continue with the free Starter tier.

Question 3

How do I create an account?

Accepted Answer

Visit duluthpath.com and click Get Started. Enter your work email, company name, and create a password. You'll receive a verification email — click the link to activate your account. If your organization uses SSO, your admin may have already provisioned your account automatically via SCIM directory sync.

Question 4

What are the system requirements?

Accepted Answer

DuluthPath runs in any modern web browser (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+). No software installation required for the cloud version. For self-hosted deployments, see the Self-Hosting section.

Question 5

How do I invite team members to my organization?

Accepted Answer

Go to Admin → Organization Settings → Members. Click Invite and enter their email addresses. You can assign roles (Admin, Manager, Analyst, Viewer) at invite time. If SSO is configured, users are automatically provisioned on first login.

Question 6

What data sources can I connect?

Accepted Answer

DuluthPath integrates with SAP, Salesforce, HubSpot CRM, Microsoft Excel/CSV files, REST APIs, databases (PostgreSQL, MySQL, MongoDB), and custom data feeds. Contact us for specific integration requests.

Question 7

What is the Connect → Verify operating sequence?

Accepted Answer

Connect → Map → Activate → Detect → Explain → Prioritize → Act → Verify is the end-to-end operating sequence every DuluthPath tenant moves through: • Connect — authorize read-only access to the systems you select (ERP, CRM, WMS, data warehouse). Least-privilege by default.
• Map — DuluthPath maps canonical business objects (contract, order, invoice, payment, PO, inventory, agent action) across your systems. Your data owners validate before anything activates.
• Activate — pick problem packs (Protect Revenue · Release Cash · Prevent Disruption · Govern Enterprise AI) you want monitored.
• Detect — triggers (threshold breach, pattern anomaly, cross-system mismatch, schedule, manual scan, upstream event) fire detections.
• Explain — DuluthPath attaches causal reasoning and affected systems.
• Prioritize — detections are impact-ranked against your business priorities.
• Act — the Decision Queue surfaces each item with its authorization matrix. Observe takes no action; Recommend drafts an action; Execute runs low-risk actions automatically and routes medium/high through HITL approval.
• Verify — DuluthPath checks that the action corrected the problem and records the verified outcome. "An action is not considered successful until the intended outcome is verified."

Question 8

What are Observe, Recommend and Execute modes?

Accepted Answer

Operating mode controls how much authority your organization grants DuluthPath. Observe is the default — you can run Problem Intelligence for weeks without a single write to your systems. You progressively authorize up as trust is established. • Observe — Detect, explain, prioritize. No writes. DuluthPath can see nothing it hasn't been granted and change nothing. Default for every new tenant.
• Recommend — DuluthPath drafts a specific recommended action per detection. A human approves every one before it reaches your systems.
• Execute — Low-risk actions can auto-run per the authorization matrix. Medium and high-risk actions still require explicit human-in-the-loop approval regardless of mode — the matrix never bypasses HITL for high-impact changes. Mode is set at Step 9 of the setup wizard and can be changed at any time from the Decision Queue header.

Question 9

Which operating modes come with which plan?

Accepted Answer

Operating modes map to the three subscription tiers: • Pilot ($35,000/mo · Tier 1) — Observe only. Full Connect → Prioritize flow. No writes to your systems. Perfect for validation and the first 60–90 days.
• Enterprise ($45,000/mo · Tier 2) — Observe + Recommend. Full Decision Queue with role-based approvals (Approver + Admin seats). Human-in-the-loop on every action.
• Platinum ($75,000/mo · Tier 3) — Observe + Recommend + Execute. Full authorization matrix. Low-risk auto-execute; medium/high still HITL. Outcome verification writes back to source systems. You can start in Pilot, prove impact in Observe, and upgrade to unlock Recommend or Execute without re-onboarding.

Question 10

How does the authorization matrix work?

Accepted Answer

The authorization matrix decides who can act on a Decision Queue item based on three dimensions: • Operating mode — Observe blocks all execution. Recommend queues actions for human approval. Execute allows auto-run for low-risk only.
• Risk level — Every detection is tagged low · medium · high. Low-risk gets the fastest path; high-risk always requires an admin.
• Role — viewer / operator / approver / admin / owner. Subscription tier maps automatically: Pilot=operator, Enterprise=approver, Platinum=admin, platform admins & founders=owner. Rule of thumb: Low-risk + Execute mode + operator role = auto-executes with no HITL. Medium-risk = HITL required even when authorized. High-risk = admin role AND HITL. Every transition is logged with the acting user, role, and note so your audit trail is complete.

Question 11

How long does the 11-step onboarding wizard take?

Accepted Answer

The guided onboarding takes 30–60 minutes for most organizations and is fully resumable — every step autosaves, so you can start today and finish tomorrow without losing work. The 11 steps are: (1) Organization basics, (2) Business priorities, (3) Operating processes, (4) Systems inventory, (5) Connect or upload, (6) Problem packs, (7) Thresholds and signals, (8) Owners and approvers, (9) Operating mode, (10) Historical validation, (11) Review and activate. Until you hit Activate at Step 11, DuluthPath has not run a single detection against your data. You remain in control at every point, and you can jump back to any completed step to revise your choices.

Question 12

What does "outcome verification" actually mean?

Accepted Answer

After DuluthPath executes (or you manually approve) an action, the work isn't done — the detection stays in the Verifying state until live-system signals confirm the problem was corrected. For example: • Detected: 3 deliveries recorded in WMS but not invoiced in ERP
• Acted: AR team creates the missing invoices
• Expected verification signals: New invoice IDs appear in ERP · revenue is recognised against the correct period
• Verified: DuluthPath confirms both signals and transitions the item to Verified · the cycle closes If expected signals don't appear within the SLA you set, the item moves to Failed and is routed back to the owner for review. The Decision Queue history records every transition with the acting user, role and timestamp — your immutable audit trail.

Question 13

What SSO providers does DuluthPath support?

Accepted Answer

DuluthPath supports SAML 2.0 and OpenID Connect (OIDC), which means it works with virtually any enterprise identity provider including Okta, Azure Active Directory (Entra ID), Google Workspace, OneLogin, PingFederate, and any SAML 2.0 or OIDC-compliant IdP.

Question 14

Is my data encrypted?

Accepted Answer

Yes. All data is encrypted in transit (TLS 1.3) and at rest. Client secrets for SSO configurations are encrypted using Fernet symmetric encryption. Self-hosted customers can use their own encryption keys.

Question 15

How do I configure SSO for my organization?

Accepted Answer

Go to Admin → SSO Settings. Choose your protocol (SAML or OIDC). For SAML: paste your IdP metadata XML and configure attribute mappings. For OIDC: enter your Client ID, Client Secret, and Discovery URL. Click Test Connection to verify before enabling.

Question 16

Can I enforce SSO for all users in my organization?

Accepted Answer

Yes. In Admin → SSO Settings, toggle Enforce SSO. This disables password login for all users in your organization. You can maintain a bypass list of emergency access emails that can still use password authentication.

Question 17

What is SCIM and does DuluthPath support it?

Accepted Answer

SCIM (System for Cross-domain Identity Management) is a standard for automated user provisioning. DuluthPath supports SCIM 2.0 (RFC 7644), which means your identity provider can automatically create, update, and deactivate user accounts when people join, change roles, or leave your organization. Supported operations: Users and Groups CRUD, PATCH updates, soft-delete, and filtering.

Question 18

How does Single Logout (SLO) work?

Accepted Answer

When a user logs out of DuluthPath, the platform sends a logout request to your identity provider, destroying the IdP session as well. This prevents the scenario where logging out of DuluthPath leaves the IdP session active. SLO is supported for both SAML (SLS endpoint) and OIDC (endsessionendpoint).

Question 19

How does DuluthPath handle session security?

Accepted Answer

Sessions use short-lived JWT access tokens with rotating refresh tokens. Admins can view all active sessions (device, IP, last activity) in Admin → SSO → Sessions tab, and revoke individual sessions or all sessions for a user. Users can view and revoke their own sessions from their Profile page.

Question 20

Does DuluthPath support multi-factor authentication?

Accepted Answer

When SSO is configured, MFA is handled by your identity provider (Okta, Azure AD, etc.). DuluthPath respects the authentication requirements set by your IdP, including MFA prompts.

Question 21

How does role-based access control (RBAC) work?

Accepted Answer

DuluthPath uses a 6-tier role hierarchy: Super Admin → Org Admin → Project Admin → Editor → Analyst → Viewer. Each role inherits permissions from the roles below it and adds its own. There are 28 granular permissions (e.g., dataset:read, pipeline:execute, settings:manage) that can be viewed and customized in Admin → Authorization.

Question 22

What is ABAC and how is it different from RBAC?

Accepted Answer

ABAC (Attribute-Based Access Control) adds context-aware policies on top of role-based permissions. While RBAC asks 'what role does this user have?', ABAC asks 'what department are they in, what classification level is this data, what time is it, and what IP are they connecting from?' DuluthPath combines both: RBAC for baseline permissions, ABAC for fine-grained contextual policies.

Question 23

Can I restrict access based on data sensitivity?

Accepted Answer

Yes. DuluthPath supports a 4-tier data classification system: Public, Internal, Confidential, and Restricted. Each user has a clearance level, and they can only access data at or below their clearance. This is enforced at the query level — restricted data never reaches unauthorized users.

Question 24

What is row-level and column-level security?

Accepted Answer

Row-level security (RLS) filters database query results so users only see records they're authorized to access. Column-level security (CLS) masks or redacts sensitive fields based on the user's role — for example, a Viewer might see j@email.com instead of the full email address, while an Admin sees the full value.

Question 25

Can I simulate access policies before deploying them?

Accepted Answer

Yes. The ABAC Admin page (/admin/abac) includes a live policy simulator. Enter a test scenario (user role, department, data classification, IP address, time of day) and see whether the policy would allow or deny access, along with which specific policy rule matched.

Question 26

How does the audit log work?

Accepted Answer

Every access decision (allow or deny) is logged with the user, resource, action, decision, matched policy, IP address, and timestamp. Admins can search, filter, and export audit logs to CSV from Admin → Authorization → Audit Log. The top-denied-access list helps identify users who may need their permissions adjusted.

Question 27

Can I create custom roles?

Accepted Answer

The 6-tier hierarchy covers most use cases, but permissions within each role can be customized. Go to Admin → Authorization to see the full permission matrix and enable or disable specific permissions per role.

Question 28

Where is my data stored?

Accepted Answer

DuluthPath supports 10 data residency regions: US-East, US-West, EU-Frankfurt, EU-Ireland, UK-London, AP-Singapore, AP-Sydney, AP-Mumbai, CA-Montreal, and SA-São Paulo. Your organization selects a region during onboarding, and all data stays within that geographic boundary.

Question 29

Can I verify where my data resides?

Accepted Answer

Yes. Go to Admin → Enterprise Ops → Data Residency to see your selected region, applicable compliance frameworks (GDPR, SOC2, HIPAA, etc.), and a residency confirmation with timestamp.

Question 30

Does DuluthPath sell or share my data?

Accepted Answer

No. DuluthPath never sells, shares, or uses your data for any purpose other than providing the service you've contracted for. Your data is your data.

Question 31

How does PII protection work in documents?

Accepted Answer

Every PDF and document exported from DuluthPath is automatically scanned for PII (email addresses, SSNs, UUIDs, user names). If PII is detected, the export is blocked by default. Org Admins can override the block with an explicit confirmation, and every override is logged in the audit trail. Document metadata is sanitized — no user data appears in PDF author, creator, or keyword fields.

Question 32

Can I export or delete all my data?

Accepted Answer

Yes. Org Admins can request a full data export from Admin → Organization Settings. For data deletion, contact support or use the self-hosted admin console's data management tools. We comply with GDPR right-to-erasure requests.

Question 33

What happens to my data if I cancel my subscription?

Accepted Answer

Your data is retained for 30 days after cancellation, during which you can export everything. After 30 days, all data is permanently deleted from our systems including backups. Self-hosted customers retain their data on their own infrastructure regardless of subscription status.

Question 34

How do I see pricing?

Accepted Answer

Pricing is available after creating a free account. Sign up at duluthpath.com — no credit card required — and pricing details will be revealed on your dashboard. This ensures we can tailor pricing information to your organization's size and region.

Question 35

What plans are available?

Accepted Answer

DuluthPath offers Starter (free), Professional, and Enterprise plans. Each tier unlocks additional features like SSO, ABAC, self-hosting, and dedicated support. See the pricing page after sign-up for full details and current pricing.

Question 36

Is there a discount for annual billing?

Accepted Answer

Yes. Annual billing saves 20% compared to monthly billing. The savings are displayed on the pricing page when you toggle between Monthly and Annual.

Question 37

How does per-seat pricing work?

Accepted Answer

Plans are priced per seat (user). You can adjust the number of seats using the slider on the pricing page to see real-time cost calculations. Seats can be added or removed at any time — charges are prorated.

Question 38

What currencies do you support?

Accepted Answer

DuluthPath supports 5 currencies: USD, EUR, GBP, CAD, and AUD. Currency is automatically selected based on your region but can be changed manually on the pricing page.

Question 39

Do you offer discounts or coupons?

Accepted Answer

Yes. Promotional coupons can be applied during checkout. Contact our sales team for volume discounts on Enterprise plans with 50+ seats.

Question 40

Will my price change if you update your plans?

Accepted Answer

No. DuluthPath uses plan grandfathering — your price at the time of subscription is locked in. If we raise prices for new customers, your existing rate is preserved.

Question 41

Can I run DuluthPath on my own servers?

Accepted Answer

Yes. DuluthPath offers a self-hosted deployment option via Docker Compose. You receive the full platform as a set of Docker images that run on any Linux server with Docker installed. Your data never touches DuluthPath's cloud infrastructure.

Question 42

What are the system requirements for self-hosting?

Accepted Answer

Minimum: 4 vCPU, 16GB RAM, 100GB SSD, Docker 24+, Ubuntu 22.04+ or any Linux with Docker support. Recommended: 8 vCPU, 32GB RAM, 200GB NVMe for production workloads with 50+ users.

Question 43

How do I install the self-hosted version?

Accepted Answer

Download the deployment package from your account dashboard. It includes a docker-compose.yml, Dockerfiles, .env.example, and a README with step-by-step instructions. Run docker compose up -d to start all services. The platform will be accessible at your configured domain within minutes.

Question 44

How does licensing work for self-hosted?

Accepted Answer

Self-hosted instances require a license key (JWT format) that specifies your plan, seat count, enabled features, and expiry date. Enter the license key in Admin → Self-Hosting. The license is validated locally — no internet connection required. A 14-day grace period is provided after expiry before features are restricted.

Question 45

How do I update my self-hosted instance?

Accepted Answer

Check Admin → Self-Hosting → Check for Updates to see if a new version is available. Updates are applied by pulling new Docker images and running docker compose up -d. A pre-update backup is recommended and can be triggered from the admin console.

Question 46

Can I run DuluthPath without internet access (air-gapped)?

Accepted Answer

Yes. The self-hosted version runs fully offline. License validation is done locally using Ed25519 cryptographic signatures. Updates in air-gapped environments are applied by transferring Docker image tarballs via secure media.

Question 47

What monitoring is available for self-hosted?

Accepted Answer

Admin → Self-Hosting shows real-time system health: service status (API, database, cache), disk usage, memory, CPU, active users, requests per hour, and error rate. You can configure alert thresholds for email/webhook notifications.

Question 48

Is telemetry sent back to DuluthPath?

Accepted Answer

Telemetry is OFF by default and fully optional. If enabled, only aggregate usage metrics are collected (total users, feature usage counts, uptime) — never customer data, query content, or PII. A telemetry manifest listing every data point is available in the admin console for your review before enabling.

Question 49

How does the multi-pass document engine work?

Accepted Answer

Documents are generated through a 4-pass pipeline: Outline (structure and sections), Content (detailed writing per section), Enrichment (data binding, charts, tables), and Validation (quality checks including minimum word counts, readability scoring, and banned-phrase detection). This ensures every document meets professional standards.

Question 50

What types of documents can DuluthPath generate?

Accepted Answer

DuluthPath includes 10 built-in professional document templates: Security Assessment, Business Case, Vendor Due Diligence, Risk Assessment, Quarterly Review, Customer Success Plan, Incident Postmortem, Compliance Policy, Executive Briefing, and Data Export. Custom templates can be created by Org Admins.

Frequently Asked Questions

Getting Started

Problem Intelligence & Operating Modes

Security & SSO

Authorization & Access Control

Data & Privacy

Pricing & Plans

Self-Hosting

Documents & Reports

Integrations

Account & Administration

Enterprise & Compliance

What's New