Personal accounts and 2FA
Administrative access uses personal user accounts. Passwords are stored as hashes. TOTP secrets are encrypted and recovery codes are hashed. 2FA is available on every plan and can be required by project assignments. Signed-in devices are visible in the account and can be revoked individually.
Project, role and area permissions
Project membership, role, individual permissions and optional area assignments are enforced on the server. API tokens are additionally bound to an ADMIN area and explicit scopes. There is no general administrative project code.
Version protection and traceability
Write actions use expected state versions and unique action identifiers. Stale control states are rejected. Relevant server and client events can be logged with user, session, device, area and application version. This provides a traceable action history, but it is not an immutable audit archive.
GuestCode, guest link and display code
Code-based access leads only to an explicitly approved VIEW area. Access values are shown in plain text once and are then stored as hashes. Validity, revocation and failed attempts are limited or logged.
Operational readiness and pending acceptance
HTTPS, security headers, local assets and separate sessions are provided. The prepared retention model evaluates candidates and blocking reasons in read-only mode; its production schema is not active and no production deletion or anonymisation mode exists. Legally approved retention periods, automated backups, restore exercises, monitoring and a fully rehearsed incident process remain prerequisites for binding security or availability commitments. No SLA is therefore offered.