Concorbit HelpAll guides →

Security & Authentication

Security & Authentication

concorbit provides multiple layers of security to protect your workspace: strong password requirements, two-factor authentication (TOTP and passkeys), session management, MFA enforcement policies, and encryption at rest for sensitive data.

Password Requirements

When setting or changing a password, concorbit enforces the following requirements:

  • Minimum length: 8 characters.

  • Strength indicator: The password change form includes a live strength meter that evaluates your password in real time and rates it from weak to strong.

  • Current password verification: Changing your password or email requires entering your current password first.

Changing Your Password

  1. Go to Settings > Profile (URL: /settings/profile).

  2. Scroll to the Password section.

  3. Enter your current password.

  4. Enter your new password. Watch the strength meter for feedback.

  5. Confirm the new password.

  6. Click Save.

Two-Factor Authentication (MFA)

Two-factor authentication adds a second verification step after entering your password. concorbit supports two MFA methods:

TOTP Authenticator App

Time-based One-Time Passwords (TOTP) work with any standard authenticator app:

  • Google Authenticator

  • Authy

  • 1Password

  • Microsoft Authenticator

  • Any TOTP-compatible app

Setting Up TOTP

  1. Go to Settings > Two-Factor Authentication (URL: /settings/mfa).

  2. If MFA is not yet enabled, you will see a QR code and a manual entry key.

  3. Scan the QR code with your authenticator app.

    • Alternatively, tap "enter manually" in your app and type the secret key shown below the QR code.

  4. Your authenticator app now generates 6-digit codes that refresh every 30 seconds.

  5. Enter the current 6-digit code in the Verification code field.

  6. Click Verify and enable.

If the code is correct, TOTP is enabled and a green "Authenticator app enabled" banner appears.

Disabling TOTP

  1. Go to Settings > Two-Factor Authentication.

  2. In the "Disable" section, enter your account password.

  3. Click Disable.

Warning: Disabling TOTP removes this layer of protection. If your role requires MFA (see MFA Enforcement), you will be required to re-enable it.

WebAuthn Passkeys (FIDO2)

Passkeys use your device's biometric sensor (fingerprint, face recognition) or a physical security key (YubiKey, etc.) as a second factor. Passkeys are phishing-resistant and generally more secure than TOTP codes.

Prerequisites

  • A browser that supports WebAuthn (Chrome, Firefox, Safari, Edge, all modern versions).

  • A compatible authenticator: fingerprint reader, Face ID/Touch ID, Windows Hello, or a FIDO2 security key.

Registering a Passkey

  1. Go to Settings > Two-Factor Authentication (URL: /settings/mfa).

  2. Scroll to the Passkeys section (only visible if your browser supports WebAuthn).

  3. Enter a name for the passkey (e.g., "MacBook fingerprint", "YubiKey 5C").

  4. Click Add passkey.

  5. Your browser will prompt you to authenticate with your device (touch the fingerprint sensor, look at the camera, or insert and touch your security key).

  6. Once verified, the passkey appears in the registered passkeys list.

You can register multiple passkeys (e.g., one for your laptop, one for your phone, and a backup security key).

Managing Passkeys

Each registered passkey shows:

  • Name: the label you gave it.

  • Domain: which domain the passkey works on.

  • Last used: when it was last used for authentication.

Available actions:

  • Rename: click to change the passkey's display name.

  • Remove: click to delete the passkey. Confirm in the dialog.

If your workspace uses a custom domain (e.g. app.yourcompany.com) as well as
your yourworkspace.concorbit.com address, a passkey only works on the exact
domain it was created on — this is a security requirement of the passkey
standard, not a Concorbit limitation. If you sign in on both, register a
passkey on each; the Two-Factor Authentication page tells you when you're
missing one for the domain you're currently on.

Using a Passkey During Login

When you log in and MFA is required:

  1. The MFA challenge page appears.

  2. If you have registered passkeys, a Use passkey button appears at the top.

  3. Click it. Your browser prompts you to authenticate with your device.

  4. Once verified, you are logged in.

Alternatively, you can always fall back to entering a TOTP code below the passkey button.

Backup Codes

If you lose access to your authenticator app and all passkeys, you can use a backup code to regain access.

Using a Backup Code

  1. On the MFA challenge page during login, click Use a backup code.

  2. Enter one of your backup codes in the format XXXX-XXXX.

  3. Click Verify.

Each backup code can only be used once. After using a backup code, re-enable your authenticator app or register a new passkey as soon as possible.

Trusted Devices

When completing MFA during login, you can check the Trust this device for 30 days option. This means:

  • Your current browser on this device will not be asked for a second factor for 30 days.

  • After 30 days, you will be prompted for MFA again.

  • If you clear your browser cookies, the trust is removed and you will need MFA on the next login.

Trusted device status is per-browser, per-device. Trusting your laptop does not trust your phone.

Session Management

Viewing Active Sessions

Go to Settings > Active Sessions (URL: /settings/sessions) to see all your active browser sessions. Each session shows:

  • Browser and operating system (e.g., "Chrome on macOS").

  • IP address.

  • When the session was created.

  • Whether it is your current session.

Revoking Sessions

To sign out a specific session (e.g., a device you no longer have access to):

  1. Find the session in the list.

  2. Click Revoke.

  3. That session is immediately invalidated. The device is signed out.

You cannot revoke your current session from this page (use the normal logout to end your current session).

Why Revoke Sessions?

  • You lost a device or had it stolen.

  • You used a shared or public computer and forgot to log out.

  • You see an unfamiliar session and suspect unauthorised access.

MFA Enforcement by Admin

Workspace administrators can require MFA for specific roles. This is configured in the Roles & Permissions page.

How Enforcement Works

  1. An admin edits a role and enables "Require MFA for this role".

  2. A grace period is set (0, 90 days, default 14).

  3. Allowed MFA methods are selected (TOTP, Passkey, or both).

What Users Experience

  • During grace period: After logging in, users see a prompt encouraging them to set up MFA. They can dismiss it and continue working.

  • After grace period: Users are redirected to the MFA setup page on every login and cannot access the workspace until MFA is configured.

Checking MFA Status

Administrators can see which users have MFA enabled from the Users page. The MFA column shows "On" or "Off" for each user.

Login Rate Limiting

concorbit protects against brute-force login attacks with rate limiting:

  • After multiple failed login attempts from the same IP address, the login form is temporarily locked.

  • The lock duration increases with each subsequent failed attempt.

  • A message on the login page indicates when the user can try again.

This applies to both password-based login and MFA code verification.

Encryption at Rest

Vault Encryption

The Vault module stores sensitive data (passwords, API keys, credentials) using AES-256-GCM encryption at rest:

  • Each secret value is encrypted before it is written to the database.

  • The encryption key is derived per-tenant, ensuring that one tenant's data cannot be decrypted with another tenant's key.

  • Decryption only occurs when a user with the vault.reveal permission explicitly clicks to reveal a secret value.

  • Reveal events are logged in the audit log, providing a complete trail of who accessed which secrets and when.

Database Encryption

All data at rest is stored on encrypted volumes. This is a platform-level control that does not require any user configuration.

Transport Encryption

All communication between your browser and concorbit uses TLS 1.2 or higher (HTTPS). API requests must also use HTTPS.

Security Best Practices

For Individual Users

  1. Enable MFA: use both TOTP and a passkey for maximum security.

  2. Use a strong, unique password: do not reuse passwords from other services.

  3. Review active sessions regularly: revoke any sessions you do not recognise.

  4. Do not share your account: each team member should have their own account.

  5. Store backup codes securely: keep them in a password manager, not in a text file on your desktop.

For Workspace Administrators

  1. Enforce MFA for all roles: especially roles with access to Vault, Billing, or Settings.

  2. Set short grace periods: 0 days for high-security roles, 7, 14 days for general staff.

  3. Review the audit log regularly: look for unusual activity patterns.

  4. Use the principle of least privilege: assign the minimum permissions each role needs.

  5. Disable unused accounts promptly: when someone leaves the team, disable their account immediately.

  6. Keep support access off: only enable it when you actively need help, and use the shortest window possible.

  7. Configure your own SMTP: to prevent email-based account recovery from being routed through shared infrastructure.

Responding to a Security Incident

If you suspect unauthorised access to your workspace:

  1. Immediately go to Settings > Active Sessions and revoke all unfamiliar sessions.

  2. Change your password from Settings > Profile.

  3. Check the audit log for actions you did not perform.

  4. Disable any compromised user accounts from Settings > Users.

  5. Revoke API tokens that may have been exposed.

  6. Contact concorbit support if you need assistance investigating.