Security
Sign in
Section titled “Sign in”Authentication uses short lived JWT access tokens with rotating refresh tokens and a blacklist on rotation. Login, registration and password reset endpoints are rate limited.
Two factor authentication
Section titled “Two factor authentication”Any user can require an email code at sign in. The platform sends a six digit code that expires after ten minutes and withstands five attempts. Both the app and the dashboard walk through the code step natively.
Biometric app lock
Section titled “Biometric app lock”The employee app offers Face ID and fingerprint lock. When enabled, the app locks on backgrounding and asks for biometrics on return. The system auth sheet itself never triggers a relock.
Audit trail
Section titled “Audit trail”Every mutating admin action is recorded by middleware: who, what, when, which endpoint and the submitted changes with sensitive fields stripped. The dashboard presents the trail with filters, and entries cannot be edited from the interface. Workspace exports require the admin role, and every export appears in the trail.
Data protection
Section titled “Data protection”Passwords hash with Django’s defaults. Media files stay inside the workspace and travel only in exports. On the hosted plan data lives in the EU. Self hosted deployments choose their own region, which is the strongest answer available.