Security (status)
Demo: administration is view-only – saving is blocked on the server.
Technical and organisational measures (TOMs) at a glance – without keys or passwords. Settings under Users & permissions › Security.
7active
5optional / off
| ✓ | Password policy | At least 12 characters · complexity or passphrase · leak list (8181 entries) · history 5 |
| ✓ | Two-factor sign-in (TOTP) | active for 0 of 7 users · not required (default) |
| ✓ | Forgotten password (email) | Demo: flow visible, email only in the log |
| ✓ | Login lockout | after 5 failed attempts, increasing delay up to 900 s, per account and IP |
| ○ | HTTPS redirect | off (default) – switch on once the installation is permanently reachable via HTTPS |
| ○ | HSTS | off (default) |
| ○ | Base address for links | not set – “Forgot password” sends no links |
| ✓ | Sign out after inactivity | after 480 minutes |
| ✓ | Security headers & cookies | nosniff · Referrer-Policy · CSP · cookies HttpOnly, SameSite, Secure with HTTPS · connection: HTTPS |
| ○ | Encryption of data at rest | off (default) · no key yet |
| ✓ | Always encrypted | access keys of the integrations · two-factor secrets · SMTP password |
| ○ | Email sending | log only (test phase) |
What you should do
- Before switching on encryption: check the backup, then keep the key file separately and protected (password manager, offline storage).
- For “forgotten password”, set up email sending and keep an email address for everyone.
- Require two-factor sign-in at least for admins once everyone has an authenticator app.
- Switch on HTTPS redirect and HSTS only once the installation runs permanently via HTTPS.