Password & Authentication Policy¶
| Field | Value |
|---|---|
| Owner | Puneet Gupta (Co-Founder) |
| Classification | Internal (shareable under NDA) |
| Version | 1.0 |
| Effective date | 2026-06-11 |
| Next review | 2027-06-11 |
1. Purpose¶
Define authentication and password requirements for the Pixis platform and Revzio's systems.
2. Application authentication¶
- Users authenticate with a username/email and password; sessions are managed with signed JWT tokens transmitted over TLS 1.2+.
- Passwords are never stored in plaintext. They are hashed using bcrypt with a unique per-password salt.
3. Password policy¶
Passwords for the Pixis platform must meet the following requirements (enforcement being implemented in the application as an immediate priority):
- Minimum length of 12 characters.
- A mix of character types (upper, lower, number, symbol) or passphrase-equivalent strength.
- Rejection of common, breached, or trivially guessable passwords.
- Account lockout / rate-limiting after repeated failed login attempts.
- No reuse of recent passwords; reset via a secure, time-limited flow.
4. Multi-factor authentication (MFA)¶
MFA (TOTP at minimum) is on the roadmap and will be enforced for administrative/superadmin accounts first, then offered for all users. (Planned — tracked in the auth-hardening task.)
5. Infrastructure & third-party accounts¶
- Access to the cloud provider, source control, and other administrative consoles must use MFA where the provider supports it.
- Shared accounts are prohibited; each person uses their own credentials.
6. Secrets¶
Application and infrastructure secrets are kept out of source control and stored in environment configuration / secret stores. Integration credentials are encrypted at rest (AES-256-GCM).
Revision history¶
| Version | Date | Author | Change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-06-11 | Puneet Gupta | Initial draft | Puneet Gupta (Co-Founder) |