Skip to main content

Security

Two-factor authentication (MFA)​

MFA uses TOTP — the same 6-digit code as apps like Google Authenticator, Authy, and 1Password.

  • Mandatory for protected roles. Currently, the Administrator role is blocked at login until MFA is configured. The requirement is enforced on the server, not just on the screen: an existing administrator is required at the next login.
  • Voluntary for the others. Any user can enable MFA on their own profile.
  • Backup codes. When enabling it, 6 single-use codes are generated, shown only once for download or printing. They replace the app when you lose your phone. Generating new ones invalidates the old ones.

Recovery​

Without the app and without the backup codes, recovery goes through Soublox support, which can deactivate a user's MFA. It is an audited operation.

Session​

  • Access is via a session cookie (HttpOnly), with short-lived tokens.
  • The session is terminated on logout, on deactivating the user, and on changing the password.
  • Devices are deduplicated: the same browser doesn't open duplicate sessions for the same user.

IP login restrictions​

In Settings → Login restrictions you limit which IP ranges the team can log in from:

  • global company rules and rules per role;
  • ranges in CIDR notation;
  • attempts outside the range are rejected and logged.

This complements MFA: it's the network barrier, useful for teams that only access from inside the office or from a VPN.

Attempt limits​

Login and password recovery have an attempt limit per IP and per account. When exceeded, the response is 429 and the release is automatic after the waiting window.

Permissions​

Access control is by section × action, defined in the roles (see Team and permissions). Three practical consequences:

  1. Reports respect the permissions of the tables. A user doesn't see in a report the data they can't see on the screen.
  2. Export is its own permission. Having the section doesn't imply being able to download CSV.
  3. MCP inherits the role. A connected assistant answers exactly what the user who authorized access can see.

Isolation between companies​

Each workspace is isolated: queries go through Row Level Security in the database, with the company context applied to every request. There is no app query that crosses companies.

Best practices​

  1. MFA mandatory for all administrators (already automatic) and encouraged for supervisors.
  2. One account per person — never share a login.
  3. Review roles at every team change.
  4. Restrict IP when the operation comes from a fixed location.
  5. Store the backup codes in a safe, not in email.