Sessions and passwords
Session lifetime, password rules, PIN policy and forced sign-out.
Passwords
Minimum 8 characters, stored hashed with bcrypt. A password is never emailed back to you — not at signup, not at reset.
Temporary passwords
A password issued by an admin carries an expiry. Before it lapses the holder is forced to change it at login; after it lapses, sign-in is refused until a new one is issued or the account is recovered by password reset.
PINs
Four digits, stored hashed. Approving with a PIN issues a single-use token bound to the specific action, which the endpoint then demands — so the prompt cannot be bypassed.
Rate limiting
| Area | Limit |
|---|---|
| Login, password reset, password change, PIN verification, account deletion and export | 10 per 15 minutes |
| Signup | 5 per 15 minutes, per IP address |
| Changes generally | 60 per minute |
| Reads | 200 per minute |
Failed sign-ins are recorded
Both successful and failed sign-ins are written to the audit trail with the reason for failure and the originating address.
Still stuck? We answer every message.Contact support