Sign-in security

The password

Every password must have at least 8 characters, one uppercase letter, one lowercase letter, a number and a special character. Passwords that are too common, and those containing the first part of your email address, are rejected. The same rules apply at signup, at registration, when the password is changed during onboarding and when it is reset. In the password change from the Edit Profile window, in the current version, only the minimum length of 8 characters is checked: choose a strong password anyway.

Passwords are stored only as a cryptographic hash: nobody, not even support, can read them. Temporary invitation passwords are 12 characters long, are generated at random and must be changed at first sign-in.

Lockout after failed attempts

Two protections, described in Signing in to the platform: a limit per network connection (5 attempts in 15 minutes) and a progressive lockout per account (15 minutes after 10 attempts, one hour after 20 with a warning to the administrators, permanent after 30). Administrators unlock from Locked users.

The session

• The session lasts one hour and does not renew itself: when it runs out you go back to the sign-in page with a warning. There is no "remember me" checkbox.
• The session token is valid only for the organisation that issued it: it cannot be used on another company's workspace.
• Logout closes the session on this device.

Roles and separation

• Every organisation has a separate database: people in one company cannot see anything belonging to another, and every file (certificates, photos, logos) is kept in a space reserved for that organisation.
• Permissions follow the role: an employee sees only their own data and whatever the organisation has chosen to show in the calendar; administrators see everything. See Roles and permissions.
• Profile photos are visible only to signed-in people from the same organisation.

The operations log

The platform records successful and failed sign-ins, account lockouts and unlocks, approvals and rejections of requests and registrations, changes to vacation allowances, deletions of requests and people, public holiday imports and changes to the quotas of leave types, with date, time and originating connection. For the other settings it keeps a record of who saved and when. Sign-in entries are kept for 12 months; the rest for the duration of the contract. The log cannot be read from the panel: if you need it, write to support.

The security emails

Administrators get an email when an account is locked for an hour or banned: Security Alert: Account Locked - {email} and CRITICAL: Account Permanently Banned - {email}, with the recommended steps.

What does not exist

Sign-in with external providers, two-factor authentication and Single Sign-On (planned for the Enterprise plan) are not available. There is no sign-out from all devices in the panel.

Tips

• Use a password you do not use on other services, and keep it in a password manager.
• If you get a lockout email for an account that never tried to sign in, unlock it and ask the person to change their password.
• Check from time to time in Employees that people who have left the company are inactive: an inactive account cannot sign in and does not take up a seat.