Access Security, MFA (TOTP) & Session Control
Concurrent active sessions registry, remote session termination, RFC 6238 TOTP two-factor authentication, and tenant brute-force lockout governance.
On this page(3)
Concurrent Device Session Registry
Administrators and employees can view real-time concurrent active sessions across mobile, desktop, and tablet devices.
Each session record reflects client device type, geographic location, IP address, and last activity timestamp. Users can remotely revoke suspect sessions individually or terminate all other active sessions with a single click.
Two-Factor Authentication & Account Governance
Two-Factor Authentication is powered by standardized Time-Based One-Time Passwords (TOTP), fully compatible with Google Authenticator, Apple Passwords, 1Password, and Microsoft Authenticator.
Upon enrollment, Sferafy presents an authenticator QR code and issues 8 single-use emergency recovery backup codes, ensuring uninterrupted account recovery if a mobile device is lost.
Brute-Force Lockout & Idle Governance
Workspace administrators can enforce organizational access policies at '/settings/security':
• Session Idle Timeout: Automatically terminates sessions after 15m, 30m, 1h, 4h, or 12h of inactivity.
• Lockout Thresholds: Temporarily disables login after 3, 5, or 10 consecutive failed attempts.
• Lockout Penalty Duration: Imposes a cool-off window (5m, 15m, 30m, 60m) to thwart automated brute-force attacks.
• Mandatory 2FA: Enforces two-factor authentication for administrative and HR roles.