Manual Security
Swifto protects your access and your data at several levels: personal passwords, reset via a one-time link (30 min), brute-force protection (5 attempts / 15 min) and strict multi-tenant isolation between companies.
Overview
Swifto's security combines the protection of access (who can log in) and the protection of data (who sees what). Accounts are protected by password, the login process is hardened against attacks, and each company is fully isolated from the others. These mechanisms are always active, with no configuration required from the user.
Purpose
- Protect each account with a password
- Reset without transmitting a secret
- Block repeated attempts
- Partition data by company
Target audience
- Administrator — drives the access policy
- Manager — unlocks their users
- User — manages their password
Security by default
Brute-force protection, the reset link and multi-tenant isolation are active with no setup required. Overview: Administration module.
The 4 pillars
Password
Each user has their own personal password (min. 6 characters, to be confirmed).
Reset via link
One-time secure link, valid for 30 minutes — no plaintext password.
Brute-force protection
5 failed attempts → account locked for 15 minutes.
Multi-tenant isolation
Each company sees only its own data.
Password
Each user has a personal password of at least 6 characters, to be confirmed when entered. It can be changed from the user's record or their personal profile.
From their record
The user (or an authorized profile) changes the password and confirms it.
Reset
If forgotten, the secure link allows a new password to be set.
The password is created when the account is opened — see Users & rights.
Reset via link
Forgotten password? A one-time secure link, valid for 30 minutes, is sent by email. No password is transmitted in plaintext: the user sets their own new password via the linked page.
Password reset
Secure link received by email — valid 30 min, one-time use.
| Characteristic | Detail |
|---|---|
| Channel | Email sent to the account's address. |
| Validity | 30 minutes — after this time, the link expires. |
| Usage | One-time use — the link is no longer valid after the reset. |
| Secret | No password transmitted in plaintext by email. |
Always prefer the reset link rather than sharing a password by email or message.
Brute-force protection
To counter automated login attempts, Swifto locks an account after 5 failed attempts. The account unlocks itself after 15 minutes. The counter resets to zero after a successful login.
failed attempts before lockout
minutes of automatic lockout
counter reset to zero on success
A locked account can be unlocked immediately via a password reset, without waiting for the 15 minutes to end.
Multi-tenant isolation
Each company sees only its own data. Any attempt to access a record belonging to another company is denied, even by forcing a URL or an identifier.
flowchart LR
U1([User Company A]):::s --> A[(Company A data)]:::ok
U2([User Company B]):::s --> B[(Company B data)]:::ok
U1 -.->|forced access| X{{Denied}}:::ko
X -.-> B
classDef s fill:#F1F5F9,stroke:#334155,color:#1E293B;
classDef ok fill:#D1FAE5,stroke:#10B981,color:#065F46;
classDef ko fill:#FEE2E2,stroke:#EF4444,color:#991B1B;Isolation is applied on every data access: selection, display, editing and deletion are always limited to the logged-in user's company. See the multi-company setup.
Rights by profile
Beyond access, privilege profiles determine what each user can do, screen by screen. This is the second layer of security, complementary to data isolation.
7 rights per screen
View, Create, Edit, Delete, Activation, Reset, Synchronization.
Least privilege
Grant only the necessary rights; reserve Deletion for administrators.
Full detail of profiles and rights: Users & rights.
Reset workflow
flowchart LR A([Forgotten password]):::s --> B[Reset request]:::p B --> C([Email with link
one-time · 30 min]):::ok C --> D{Valid link?}:::p D -->|yes| E([New password]):::ok D -->|expired / already used| F([Denied — retry]):::ko classDef p fill:#f3f1ff,stroke:#7366fe,color:#1f1c3d; classDef s fill:#F1F5F9,stroke:#334155,color:#1E293B; classDef ok fill:#D1FAE5,stroke:#10B981,color:#065F46; classDef ko fill:#FEE2E2,stroke:#EF4444,color:#991B1B;
Business rules
Password ≥ 6 characters — entered and confirmed both at creation and at reset.
One-time link — valid for 30 minutes, with no plaintext secret transmitted.
5 / 15 lockout — 5 failures lock the account for 15 minutes; the counter resets to zero on success.
Strict partitioning — no user can view or edit another company's data, even by forcing a URL.
Best practices
Principle of least privilege
Grant each profile only the strictly necessary rights. Reserve Deletion for administrators.
Renew passwords
Encourage strong passwords and their regular renewal via the reset link.
One account = one person
Never share an account: brute-force lockout and the logs would become unusable.
Disable rather than delete
When someone leaves, disable the account rather than deleting it, to preserve traceability.
FAQ & Tips
A user is blocked at login?
They have most likely exceeded 5 attempts: the account unlocks itself after 15 minutes, or immediately via a reset.
The reset link no longer works?
It may have expired (30 min) or already been used. Submit a new request to receive a new link.
Can I see the data of another company in the group?
No: multi-tenant isolation partitions each company. Log in to the correct company to access its data.
Tip — raise your teams' awareness
Remind everyone of the basics: one account per person, passwords not shared, and systematic use of the reset link.
