Sessions and passwords
Session lifetime, password rules, PIN policy and forced sign-out.
Passwords
Minimum 8 characters, stored hashed with bcrypt. A password is never emailed back to you — not at signup, not at reset.
Temporary passwords
A password issued by an admin carries an expiry. Before it lapses the holder is forced to change it at login; after it lapses, sign-in is refused until a new one is issued or the account is recovered by password reset.
Two-factor at sign-in
A password on its own is not normally enough: an emailed six-digit code is required as well, and it is on by default for every account. A device can be trusted for 30 days, and an admin can revoke that. See Two-factor authentication.
PINs
Four digits, stored hashed. Approving with a PIN issues a single-use token bound to the specific action, which the endpoint then demands — so the prompt cannot be bypassed.
Rate limiting
| Area | Limit |
|---|---|
| Login, password reset, password change, PIN verification, account deletion and export | 10 per 15 minutes |
| Signup | 5 per 15 minutes, per IP address |
| Changes generally | 60 per minute |
| Reads | 200 per minute |
Failed sign-ins are recorded
Both successful and failed sign-ins are written to the audit trail with the reason for failure and the originating address.