Security and two-factor authentication

Signing in

You sign in with an email address and a password. If you have a second factor enrolled, you then complete a challenge at /auth/mfa before you reach the app.

Setting up the second factor

Enrolment is at /2fa. Exedra Gate uses a time-based one-time password, which is the standard six-digit code from an authenticator app.

On a desktop browser you scan a QR code with your authenticator app. On a phone, where you cannot scan a code with the same device that is showing it, you copy the setup key into the app instead. Both routes enrol the same factor.

You can replace your authenticator later, but only after entering a current valid code from the existing one first.

Why there are no SMS or email codes

Exedra Gate does not send authentication codes by SMS, WhatsApp or email. Those channels are being phased out for authentication because they are interceptable and redirectable. The authenticator app is the supported second factor.

Where the second factor is required

Protected areas require the elevated session, not just a password. Consequential actions check it again on the server, including expressing interest in an offering, starting your own identity check, and offering changes. A password-only session is refused at the endpoint, not merely hidden in the interface.

Losing your authenticator

Use the support path at /support and choose account recovery. Recovery is handled by a human. Support cannot see your password and will not read codes back to you.

Tenant isolation

Your data is separated at the database level by row level security. Every tenant-scoped table carries a policy, and endpoints authorise as you rather than reading with elevated rights and filtering afterwards. This is the isolation boundary, not a convention that the interface follows.