Account Security and Login Protection

What's in place

Passwords are hashed with bcrypt (never stored in plain text). Sessions last 8 hours before requiring a fresh login. Repeated failed login attempts on an account trigger a temporary lockout after 5 failures, for 15 minutes, to slow down anyone guessing at a password. On top of that, the platform automatically blocks (bans) a network address entirely for an hour if it racks up repeated failed logins across accounts — a broader defense against anyone systematically trying to break in, not just guessing at one account.

Why these specific protections

Password hashing is table-stakes for any system holding real customer and business data. The login lockout exists because without it, an attacker could try passwords indefinitely and quickly — a short lockout after a handful of failures makes that impractical while barely inconveniencing someone who just mistyped their own password once or twice. The network-level ban exists because a determined attacker could otherwise just try different accounts from the same source instead of hammering one — blocking the source itself closes that gap.

When you'd notice this

If you or a teammate mistype a password several times in a row, you'll see a "temporarily locked" message — wait the 15 minutes and try again, or reset your password if you're not sure of it.

How to keep your account secure

• Use a real, unique password — not one reused from another service.
• Only invite people you trust with the appropriate role (see Managing Permissions) — every team member with access can see your organization's data at whatever level their role allows.
• If you suspect an account has been compromised, change its password immediately and review your Team settings for anyone you don't recognize.