Security settings and audit log

Sign-in protections

• Passwords are stored hashed, never in clear text, and must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a special character.
• Lockout: five failed sign-ins lock the account for 15 minutes. Sign-in, password reset and invitation requests are also rate-limited.
• Authenticator codes (TOTP): an account with MFA asks for a 6-digit code after the password. Enrollment issues 10 single-use recovery codes, shown once. The authenticator secret is stored encrypted.
• Sessions: access tokens are short-lived and renewed while you work. The app signs you out after 30 minutes of inactivity, and signing out also revokes your token on the server.
• API keys are hashed, shown once and revocable (API keys).

The web app does not yet have screens for MFA enrollment, changing a password, requesting a reset or signing out everywhere. These are available through the API, and your Client Administrator or TrekShield can help with a reset (FAQ).

Audit log

Every create, update and delete made through the platform is recorded with the user, the action, the record affected, the time, the IP address and the browser. Request details are stored with sensitive fields, such as passwords, tokens and secrets, redacted.

• Who can read it: Platform Administrators and Engagement Managers, from Audit Log. Filter by resource, action, date range or user name; Platform Administrators can export CSV. The organization-wide log is not shown to customer roles.
• What you can see: every engagement, finding, remediation and retest has a Timeline with each state change, who made it and when.

For the roles behind these permissions, see team and roles.