Integration and operations
Accounts
Registration, administrator approval, roles and the audit log.
Registration requires a username, email address, organisation and stated purpose of use. No confirmation email is sent; an administrator approves the account.
| Status | Means |
|---|---|
pending | Registered, waiting for an administrator |
active | Approved and able to sign in |
disabled | Blocked. Existing sessions stop working immediately. |
- Passwords are hashed with Argon2id. Session tokens are stored as digests only.
- Repeated failures trigger rate limiting and then account lockout.
- Administrative actions and tag changes are written to the audit log.
- Disabling an account revokes its sessions immediately; the check runs per request, not per cookie.