Skip to content
Chefotech HRMS
All documentation

Administration

Security settings

Password rules, sessions and the controls available to an account owner.

Open this in the app

What you control

  • Password strength requirements and expiry.
  • Session lifetime and whether concurrent sessions are allowed.
  • Failed sign-in lockout thresholds.
  • Which email domains may be invited into the account.

What we handle

Passwords are stored hashed, never recoverable. Sessions use short-lived access tokens with rotating refresh tokens, and reuse of a refresh token invalidates the whole family — a stolen token stops working the moment the real one is used.

Related