Home › Admin › Security
Admin · Security

Security Settings

Last updated: 2026-07-12

Two-factor authentication, session management, and account protection for admin users.

🔒
Super Admin only

The Security Settings page is accessible to Super Admin users. Go to Admin → Security in the sidebar.

Two-Factor Authentication (2FA)

2FA adds a second verification step at login, protecting your account even if your password is compromised. In SONAN DIGITAL CRM, 2FA is optional — each admin enables or disables it independently from their own Security Settings page.

Enabling 2FA

  1. Navigate to Admin → Security
  2. In the Two-Factor Authentication card, toggle the switch to ON
  3. The enrollment wizard opens. Open your authenticator app and scan the QR code shown.
  4. Enter the 6-digit code from your app to verify the setup
  5. Copy and securely store the recovery codes shown — you will need them if you lose your phone
  6. Click Done to complete enrollment
Compatible Authenticator AppsPlatform
Google AuthenticatoriOS, Android
Microsoft AuthenticatoriOS, Android
AuthyiOS, Android, Desktop
1PasswordiOS, Android, Desktop
Bitwarden AuthenticatoriOS, Android

Once enrolled, the Security Settings page confirms which authenticator is active and shows its verified status.

Logging In With 2FA

After entering your email and password, you are prompted for a 6-digit code. Open your authenticator app, enter the current code, and click Verify. Codes rotate every 30 seconds — if a code fails, wait for the next rotation.

Disabling 2FA

  1. Go to Admin → Security
  2. Toggle the 2FA switch to OFF
  3. Enter your current password to confirm
⚠️
Re-enrollment required after disabling

Disabling 2FA permanently removes your authenticator registration. If you re-enable 2FA later, you must scan a new QR code — your previous authenticator entry will not work.

Recovery Codes

During enrollment you receive a set of single-use recovery codes. If you lose access to your authenticator app, enter a recovery code in place of the 6-digit TOTP code at login. Each code works once only.

Store them safely — password manager, printed copy in a secure location, or encrypted file. To generate new codes, disable and re-enable 2FA (requires scanning a new QR code).

Session Security

ProtectionBehaviour
Session expirySessions expire after inactivity. You are redirected to login.
Re-authenticationSensitive actions (e.g., disabling 2FA, changing password) require password re-entry even within an active session.
MFA Assurance LevelRoutes protected by AAL2 require a valid TOTP session in addition to password login.

Login Rate Limiting

Failed login attempts are rate-limited per email address. After repeated failures, the account is temporarily locked. Contact a super admin to unlock if needed.

Security Audit Log

All MFA-related events are recorded in the Audit Log (Admin → Audit Log). Logged events include:

EventAudit Action
2FA enrolledMFA_ENROLLED
2FA disabledMFA_DISABLED
TOTP verified at loginMFA_VERIFY_SUCCESS
TOTP verification failedMFA_VERIFY_FAIL
Recovery code usedRECOVERY_CODE_USED
Recovery codes regeneratedRECOVERY_CODE_REGEN
Re-authentication passedREAUTH_SUCCESS
Re-authentication failedREAUTH_FAIL

Portal & Employee 2FA

Client portal users can enable 2FA from Portal → Settings → Two-Factor Authentication. Employee portal users use Employee → Settings. The flow is identical to the admin flow above.

Recommendations

  • Enable 2FA on all super admin accounts — these have access to billing, user management, and all tenant data
  • Store recovery codes in a password manager, not in the same email inbox as your login credentials
  • Review the Audit Log periodically for unexpected MFA_VERIFY_FAIL events, which may indicate a credential compromise attempt