Amplitude Hardening Guide
Product analytics platform hardening for Amplitude including SAML SSO, project access, and data governance
Overview
Amplitude is a leading product analytics platform serving thousands of companies for behavioral analytics and product optimization. As a platform handling user behavior data and product metrics, Amplitude security configurations directly impact data privacy and analytics integrity.
Intended Audience
- Security engineers managing analytics platforms
- IT administrators configuring Amplitude
- Product teams managing analytics
- GRC professionals assessing data security
How to Use This Guide
- L1 (Baseline): Essential controls for all organizations
- L2 (Hardened): Enhanced controls for security-sensitive environments
- L3 (Maximum Security): Strictest controls for regulated industries
Scope
This guide covers Amplitude security including SAML SSO, organization/project access, API security, and data governance.
Table of Contents
- Authentication & SSO
- Access Controls
- Data Security
- Monitoring & Compliance
- Compliance Quick Reference
1. Authentication & SSO
1.1 Configure SAML Single Sign-On
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 6.3, 12.5 |
| NIST 800-53 | IA-2, IA-8 |
Description
Configure SAML SSO to centralize authentication for Amplitude users.
Prerequisites
- Amplitude admin access
- Enterprise or Growth plan
- SAML 2.0 compatible IdP
ClickOps Implementation
Step 1: Access SSO Settings
- Navigate to: Settings → Organization Settings → Security
- Find SAML SSO section
Step 2: Configure SAML
- Enable SAML SSO
- Configure IdP settings:
- SSO URL
- Entity ID
- Certificate
- Download Amplitude metadata for IdP
Step 3: Test and Enforce
- Test SSO authentication
- Enable SSO enforcement
- Configure admin fallback access
Time to Complete: ~1-2 hours
1.2 Enforce Two-Factor Authentication
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 6.5 |
| NIST 800-53 | IA-2(1) |
Description
Require 2FA for all Amplitude users.
ClickOps Implementation
Step 1: Configure via IdP
- Enable MFA in identity provider
- All SSO users subject to IdP MFA
- Use phishing-resistant methods for admins
Step 2: Enable Amplitude 2FA (non-SSO)
- Navigate to: Settings → Security
- Enable 2FA requirement
- Users configure authenticator apps
1.3 Configure Session Security
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 6.2 |
| NIST 800-53 | AC-12 |
Description
Configure session timeout settings.
ClickOps Implementation
Step 1: Configure Timeout
- Navigate to: Settings → Security
- Configure session timeout
- Balance security with usability
2. Access Controls
2.1 Configure Organization Roles
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 5.4 |
| NIST 800-53 | AC-6 |
Description
Implement least privilege using Amplitude roles.
ClickOps Implementation
Step 1: Review Roles
- Navigate to: Settings → Members
- Review available roles:
- Admin
- Manager
- Member
- Viewer
- Understand role capabilities
Step 2: Assign Appropriate Roles
- Apply least-privilege principle
- Use Viewer for read-only access
- Regular access reviews
2.2 Configure Project Access
Profile Level: L2 (Hardened)
| Framework | Control |
|---|---|
| CIS Controls | 5.4 |
| NIST 800-53 | AC-6 |
Description
Control access to specific projects.
ClickOps Implementation
Step 1: Configure Project Permissions
- Navigate to project settings
- Assign users to projects
- Set project-specific roles
Step 2: Limit Cross-Project Access
- Separate production and test data
- Restrict sensitive project access
- Audit project membership
2.3 Limit Admin Access
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 5.4 |
| NIST 800-53 | AC-6(1) |
Description
Minimize and protect administrator accounts.
ClickOps Implementation
Step 1: Inventory Admins
- Review all admin accounts
- Document admin access
- Identify unnecessary privileges
Step 2: Apply Restrictions
- Limit admin to 2-3 users
- Require 2FA/SSO for admins
- Monitor admin activity
3. Data Security
3.1 Configure API Key Security
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 3.11 |
| NIST 800-53 | SC-12 |
Description
Secure Amplitude API keys.
ClickOps Implementation
Step 1: Review API Keys
- Navigate to: Settings → Projects → API Keys
- Review all API keys
- Document key purposes
Step 2: Secure Keys
- Store keys in secure vault
- Use secret keys server-side only
- Rotate keys regularly
Step 3: Monitor Usage
- Monitor API key usage
- Alert on anomalous patterns
- Revoke compromised keys
3.2 Configure Data Governance
Profile Level: L2 (Hardened)
| Framework | Control |
|---|---|
| CIS Controls | 3.1 |
| NIST 800-53 | AC-3 |
Description
Implement data governance controls.
ClickOps Implementation
Step 1: Configure Data Taxonomy
- Define event taxonomy
- Configure property classifications
- Apply data governance rules
Step 2: Configure Privacy Controls
- Enable PII detection
- Configure data masking
- Support deletion requests
Step 3: Configure Retention
- Set data retention policies
- Configure data deletion
- Document compliance requirements
4. Monitoring & Compliance
4.1 Configure Activity Logs
Profile Level: L1 (Baseline)
| Framework | Control |
|---|---|
| CIS Controls | 8.2 |
| NIST 800-53 | AU-2 |
Description
Enable and monitor activity logs.
ClickOps Implementation
Step 1: Access Logs
- Navigate to: Settings → Activity Log
- Review logged events
- Configure retention
Step 2: Monitor Key Events
- User authentication
- Project changes
- Permission modifications
- Data exports
5. Compliance Quick Reference
SOC 2 Trust Services Criteria Mapping
| Control ID | Amplitude Control | Guide Section |
|---|---|---|
| CC6.1 | SSO/2FA | 1.1 |
| CC6.2 | Organization roles | 2.1 |
| CC6.7 | API key security | 3.1 |
| CC7.2 | Activity logs | 4.1 |
NIST 800-53 Rev 5 Mapping
| Control | Amplitude Control | Guide Section |
|---|---|---|
| IA-2 | SSO | 1.1 |
| IA-2(1) | 2FA | 1.2 |
| AC-6 | Organization roles | 2.1 |
| SC-12 | API key security | 3.1 |
| AU-2 | Activity logs | 4.1 |
Appendix A: References
Official Amplitude Documentation:
- Trust Center (powered by Wolfia)
- Trust, Security and Privacy
- Amplitude Documentation
- Security and Privacy FAQ
- Data Governance
- Data Access Controls
API & Developer Tools:
Compliance Frameworks:
- SOC 2 Type II — via Trust Center
- ISO 27001, ISO 27017, ISO 27018 — via Trust Center
- GDPR, CCPA, HIPAA compliance
- Annual third-party penetration testing; private Bug Bounty program
Security Incidents:
- August 2024 — Data Harvesting Lawsuit (DoorDash): A lawsuit alleged Amplitude’s tracking code embedded in the DoorDash app collected geolocation and sensitive user data without consent, sharing it with marketing platforms. In September 2025, a federal judge ruled users could proceed with claims but were bound by DoorDash’s arbitration agreement. Amplitude itself was not breached. (Bloomberg Law Report)
- No major direct platform security breaches identified as of early 2026.
Changelog
| Date | Version | Maturity | Changes | Author |
|---|---|---|---|---|
| 2025-02-05 | 0.1.0 | draft | Initial guide with SSO, access controls, and data governance | Claude Code (Opus 4.5) |
Contributing
Found an issue or want to improve this guide?
- Report outdated information: Open an issue with tag
content-outdated - Propose new controls: Open an issue with tag
new-control - Submit improvements: See Contributing Guide