Authentication

Secure authentication and identity management for your whistleblowing platform users and administrators.

Overview

Authentication is the process of verifying user identity before granting access to your whistleblowing platform. Disclosurely uses email verification codes or Google or Microsoft sign-in, with MFA available in the current platform. Single Sign-On (SSO) remains planned and is not currently offered as an Enterprise control. Proper authentication ensures that only authorized personnel can access sensitive case data while maintaining detailed audit trails for compliance and security monitoring.

Strong authentication protects against unauthorized access, account takeover attempts, credential theft, and insider threats. For whistleblowing platforms handling confidential reports and reporter identities, robust authentication is essential to maintain trust, comply with regulations like the EU Whistleblowing Directive and GDPR, and prevent data breaches that could expose vulnerable whistleblowers to retaliation.

Password Requirements and Security

Passwords and Sign-In

Accounts are created with a password during sign-up. Day-to-day sign-in uses a single-use email verification code, or Google or Microsoft sign-in.

Passwords are stored and verified by our authentication provider (Supabase Auth) as salted one-way hashes. Disclosurely staff cannot view your password.

Password rules are those enforced by our authentication provider. Disclosurely does not currently offer password expiry, password-history rules or administrator-configurable password policies, and leaked-password checking is not currently enabled.

Password Best Practices

For Users:

• Use a unique password for Disclosurely (don't reuse)
• Use password manager to generate and store strong passwords
• Enable multi-factor authentication immediately
• Never share password with anyone, including support staff
• Change password if suspected compromise
• Don't write passwords down
• Use passphrase method: combine random words (e.g., "correct-horse-battery-staple")

For Administrators:

• Ask all users handling sensitive data to enable MFA
• Monitor failed login attempts
• Review password security settings quarterly
• Include password security in user training
• Disable accounts immediately upon employee departure
• Audit password reset requests for suspicious patterns

Learn more about multi-factor authentication in the MFA documentation.

Session Management

Secure Session Handling

Sessions are managed by our authentication provider using short-lived access tokens that are refreshed while you are signed in, and are only sent over HTTPS. Signing out ends the session on that device.

Session Timeouts

• Idle timeout: you are signed out after 15 minutes of inactivity, with a warning shortly before
• Maximum session: you are signed out after 8 hours, even if active

These timeouts are fixed and are not currently configurable per organisation or role.

Active Session Management

Users Can:

• View all active sessions with device and location information
• See last activity timestamp for each session
• Remotely terminate suspicious sessions
• Receive alerts for new device logins
• Review session history in security settings

Automatic Termination:

• All sessions terminated on password change
• Sessions invalidated on MFA reset
• Concurrent session limits enforced
• Suspicious sessions automatically terminated
• Sessions terminated when account disabled

Single Sign-On (SSO)

SSO is planned and is not currently available. Disclosurely does not currently offer supported SAML 2.0, OpenID Connect identity-provider integration, SCIM, or just-in-time provisioning to customers. No setup instructions or delivery date are published for these planned controls.

Review the Security Centre and Roadmap for the current public availability statement.

Authentication Best Practices

For Administrators

Security Configuration:

• Enforce multi-factor authentication organization-wide
• Set appropriate session timeout policies
• Record SSO requirements during procurement; SSO is planned rather than currently available
• Monitor failed authentication attempts
• Review authentication logs regularly
• Implement account lockout after failed attempts
• Require password changes after suspected compromise
• Document authentication policies

Access Management:

• Implement least privilege access controls
• Review user access quarterly
• Disable accounts immediately upon termination
• Use time-limited access for temporary users
• Monitor for shared accounts (prohibited)
• Audit authentication bypasses
• Test authentication controls regularly

Compliance:

• Document authentication requirements
• Include authentication in security training
• Maintain audit trails of authentication events
• Review authentication security annually
• Update policies to reflect evolving threats

Learn more about access controls in the Access Control documentation.

For All Users

Account Security:

• Enable MFA immediately after account creation
• Use strong, unique passwords
• Never share your credentials
• Don't save passwords in browsers on shared devices
• Log out when finished, especially on shared computers
• Report suspicious login notifications immediately
• Review active sessions regularly
• Use secure, trusted networks when possible

Recognizing Threats:

• Be wary of phishing emails requesting credentials
• Verify login page URL before entering password
• Don't click login links in emails
• Report suspicious password reset requests
• Contact support if you see unfamiliar active sessions
• Be cautious of social engineering attempts

For Whistleblowers (Anonymous Reporters)

Anonymous reporting doesn't require authentication:

• No account creation needed
• No login required
• Access reports using tracking ID only
• Tracking ID acts as authentication credential
• Keep tracking ID secure and private
• Don't share tracking ID with anyone
• Use secure device and network
• Consider using VPN for additional privacy

Learn more about anonymous reporting in the How to Submit a Report guide.

Troubleshooting Authentication Issues

Can't Log In

Common Solutions:

• Verify email address is entered correctly
• Check Caps Lock is not enabled
• Try password reset if forgotten
• Clear browser cache and cookies
• Try different browser or incognito mode
• Disable browser extensions temporarily
• Check MFA codes are current and correct
• Verify account hasn't been disabled

Password Reset Not Working

If reset email doesn't arrive:

• Check spam/junk folder
• Verify email address on file is correct
• Wait 5-10 minutes for delivery
• Request new reset link
• Contact your organization administrator
• Contact support if administrator unavailable

If reset link doesn't work:

• Links expire after 1 hour - request new one
• Links are single-use only
• Don't click link multiple times
• Copy and paste full URL if clicking doesn't work
• Ensure using same browser/device
• Clear cache and try again

SSO Requirements

SSO is planned. Contact Disclosurely during procurement if identity-provider integration is a requirement; do not assume it is included in an Enterprise contract.

Account Locked

If account is locked after failed logins:

• Wait 15-30 minutes for automatic unlock
• Request administrator unlock immediately
• Verify you're using correct password
• Consider password reset if uncertain
• Review security settings after unlock
• Enable MFA if not already enabled

---

Related Pages

• Multi-Factor Authentication - Enhanced account security
• Security Overview - Comprehensive security architecture
• Access Control - User permissions and roles
• Best Practices - Security recommendations