Security & Access Control

Protect your application with security groups, layered permissions, IP and account banning, plus user verification.

• Security Groups — The unit permissions are granted to, the five built-in groups and what they mean, and how membership is managed.
• Permissions — The access model itself — grant-only, layered across datastore, field and row — and how a single access decision is reached.
• Transport Security — Force HTTPS and the certificates behind it. Session settings are documented under Authentication.
• Blocked IP Addresses — The register of currently blocked addresses, how to tell an automatic block from a manual one, and how to add and remove them.
• Blocked User Accounts — The register of banned accounts, how it differs from disabled accounts, and how to clear a ban when somebody is genuinely locked out.
• Authentication Methods — How the platform identifies people — the three-part identity, local sign-in, and external providers — and how to choose between them.
• 2-Factor Authentication — Turn on a second factor, force it without locking anybody out, and choose between authenticator apps and SMS codes.
• Password Resets — Let users recover their own password by e-mail or SMS, with a time-limited link — and the identity checks that keep the process from becoming the weak point.
• IP Address Banning — Automatic banning after repeated failed sign-ins from one address, and how to tune attempts, window and ban length.
• Account Banning — Automatic banning of an account after repeated failed sign-ins, and how it complements address banning.
• Encryption — The engine that encrypts stored field data, the cipher or level that goes with it, and why these settings are chosen once.
• User Verification — Confirm who somebody is, how old they are, or what they are affiliated with — using an external provider or an e-mail domain check.
• Field Security — Per-field access for a security group — no access, read-only or writable — enforced on the server for both reads and writes.
• Record Access Roles — Row-level access: grant one person, group or team access to one record, with a reason, an expiry and a revocation trail.
• Classification & Clearance — Label records with a classification level and hold users at a clearance, so that access, export, watermarking and auditing follow the label.
• Break-Glass Access — Time-limited emergency access to a specific record, requiring a recorded reason and reviewed afterwards.
• Dual Authorisation — Four-eyes control: a sensitive action is held as a pending request until somebody in the approving group approves it.
• Consent & Tamper-Evident Audit — A consent banner that actually blocks trackers, a hash-chained audit trail, and a record of who read what.