Cloud / Pro sign-in, sync & entitlements
The optional cloud tier: how to sign in, what per-tenant sync does, the Pro entitlements that unlock features, and how to publish compliance evidence — all without ever syncing PII.
1 · Signing in
- Open the Sign in / Cloud tab.
- Click Sign in with Clerk. The sign-in component (and only then) loads, and you authenticate with your DosanjhLabs account — one login across the whole suite.
- After sign-in, the tab shows who you're signed in as and your tenant, plus the Pro feature panel.
- To sign out, click Sign out.
2 · Pro features & entitlements
After signing in, the Pro features panel checks your account's entitlements and shows each as Pro · unlocked or Locked. The entitlements are:
| Entitlement | Feature | What it unlocks |
|---|---|---|
ai_content | BYO-key AI content | Generate phishing lures and training lessons with your own LLM key (the AI content tab). |
cloud_sync | Cloud sync | Sync training progress + campaign results across devices (see below). |
msp | MSP multi-tenant console | Run per-client campaigns and reports under one login; also gates live send. |
white_label | White-label reports | Your (or your client's) brand on exported reports. |
If a feature is Locked, you'll see an Upgrade to unlock link. Entitlements are resolved server-side from your verified session — the client can't grant itself a feature, and an entitlement is scoped to your tenant so it can't unlock another tenant's plan.
3 · Per-tenant cloud sync
With cloud_sync unlocked, the Pro panel adds two buttons:
- ⬆ Sync up — pushes the active tenant's PII-free summary (completion %, campaign stats) to the cloud, stored under that tenant's own scoped key. You'll see "Synced [org] to cloud (isolated per-tenant scope)".
- ⬇ Pull from cloud — reads the active tenant's cloud summary back. If nothing's there yet, you're prompted to sync up first.
4 · Publishing compliance evidence
You can publish your training-completion records and campaign results as a canonical Awareness & Training evidence object into the shared graph, where it can be mapped across HIPAA AT, NIST 3.2.x, SOC 2 CC2, PCI 12.6, and ISO A.6.3.
- On the Sign in / Cloud tab, find the Evidence emission callout.
- Click Publish Awareness & Training evidence.
- Watchword sends the PII-free payload and confirms with the new evidence ID.
Prefer to keep it local? Use Program → Reports & exports → Evidence object (JSON) to download the same payload without publishing. The payload carries control state and framework references — never learner emails or captured data.
5 · Common cloud snags
| Symptom | Fix |
|---|---|
| Sign-in / Cloud tab stuck on "Loading the optional cloud tier…" | The cloud module isn't deployed or failed to load (offline / CSP). Everything else works fully offline — this is expected on local-only runs. |
| "Cloud sync is a Pro feature" | Your account lacks cloud_sync. Upgrade, or use local CSV/JSON exports. |
| "Nothing in the cloud yet for this tenant" | Sync up first for that client; pull only works after a push. |
| "Live send is an MSP-tier feature" | Live send needs the msp entitlement. See Sending safely. |