Security

How the Zurix demo protects accounts.

Credentials

Passwords need at least 12 characters and are hashed with PBKDF2-SHA256, 100'000 iterations, a per-user salt and a server-side pepper.
After 5 wrong passwords an account is locked for 15 minutes. Sign-in attempts are also rate-limited per network.
Error messages never reveal whether an e-mail address is registered at sign-in.
Optional two-factor authentication with any authenticator app (TOTP). Setup keys are encrypted at rest, codes cannot be replayed, and ten single-use recovery codes are issued.
A security activity log shows every sign-in, failed attempt and sensitive change, with browser type only and no IP address.

256-bit random tokens, stored server-side only as SHA-256 hashes.
15 minutes idle timeout and 8 hours absolute lifetime. You can sign out every device at once.

A strict Content-Security-Policy allows only our own scripts and styles.
HSTS, no framing (clickjacking protection), no referrer leakage, cross-origin isolation headers.
State-changing requests must come from our own origin with a JSON body (CSRF protection).

Amounts are integers in Rappen. Every transfer is one atomic database transaction, and the database itself rejects any balance below zero.

We will never ask for your password by e-mail, SMS or phone. Only sign in on your Zurix domain.