Security model

Security in Cloud Control is built into the seams, not bolted on. This page summarizes the model; the Authentication and Roles & permissions guides go deeper.

Passwords

Passwords are hashed with scrypt and never stored or logged in plaintext. A password reset proves control of an email, not of a session, so it revokes all of the user's existing sessions.

Sessions

A successful sign-in sets an `httpOnly`, `SameSite=Lax` session cookie; the stored session is a hash, so a database read never exposes a usable token. Cookies are Secure in production. Roles and capabilities are recomputed per request from the database, so a mid-session role change (or an organization suspension) takes effect on the very next request — no need to wait for re-login.

Multi-factor authentication

MFA is TOTP per RFC 6238, implemented with node:crypto only. Enrolling issues eight single-use recovery codes, shown exactly once and stored only as hashes. When MFA is on, a correct password yields a short-lived, single-use challenge token rather than a session — the session is only issued after the code is verified. See Multi-factor authentication.

Secret storage

Secrets your organization entrusts to Cloud Control — notably an OIDC client secret — are sealed in an AES-256-GCM envelope under the server key CC_DATA_KEY and never leave the server; API responses only ever report whether a secret is set. Cloud connections themselves use short-lived, assumed credentials, so there are no long-lived cloud keys to store at all.

Enumeration safety

Authentication responses never reveal whether an email exists. Sign-in returns the same message for a wrong email and a wrong password; password-reset returns the same body whether or not the address is registered; SSO start returns the same 404 whether an organization is unknown or simply has no SSO. Hidden surfaces such as the platform-admin API answer 404 (not 403) to anyone unauthorized, and cross-organization identifiers answer 404 everywhere.

Brute-force protection

Five failed sign-in attempts for the same email — existing or not — lock that email for 15 minutes with a 429; the same cap applies to wrong MFA codes per user. Both are audited. See Login protection.

Read-only cloud access

Cloud Control connects to your clouds read-only. It discovers and reports; it cannot change your infrastructure. Disconnecting a cloud account stops sync and marks discovered rows as disconnected, and reminds you to remove the role or federation config on the cloud side to fully de-provision.