Accounts are managed by a dedicated managed authentication service. Matsivo adds application-level protections on top of it to slow down automated attacks and to keep sign-in behaviour predictable for administrators.
Credentials
- Passwords must be at least 12 characters.
- Passwords are never stored in readable form — see Encryption.
- Sign-in and password-reset responses are neutral and do not confirm whether an address is registered.
Multi-factor authentication
- Time-based one-time password (TOTP) authenticators are supported.
- Organisations can require MFA; enforcement is evaluated server-side, not in the browser.
- Sensitive administrative actions are gated behind a satisfied MFA requirement.
Sessions and abuse protection
- Repeated failed attempts are throttled server-side, in addition to browser-level back-off.
- Sessions expire after a period of inactivity and have a maximum absolute lifetime.
- Signing out revokes the session across devices.
- Authentication events are written to an append-only security audit log.
Questions about this area?
Our team answers security questionnaires and reviews. Write to security@matsivo.com.