# Quiet Kindness Haven ## Security, Password Policy and Multi Factor Authentication Brief Last reviewed: 5 September 2026 Owner: Quiet Kindness Haven Studio (quietkindnessstudio@gmail.com) ### 1. Principle Soft on the surface, strong underneath. The public website stays simple and calm for visitors, while account access, private information and communication are protected behind the scenes. ### 2. Scope Public marketing website, waitlist and resource sign ups, contact and support enquiries, administrator accounts and the administration area. There are no payments, no member portal and no automated decision making on this website. ### 3. Accounts - Accounts exist only for team and administrator access. Visitors never need an account. - Registration remains open, but a new account grants no access to any private information until an administrator role is assigned. - Roles are stored in a dedicated roles table, never on a profile record, and are enforced by database level row security policies. ### 4. Password policy - Minimum length: 14 characters. - Passphrases and spaces are allowed and encouraged. - Known compromised passwords are rejected at sign up and password change, checked against the Have I Been Pwned corpus. - No arbitrary composition rules (no forced symbol or mixed case requirements). - No routine forced rotation. Passwords are changed on evidence of risk only. - Passwords are never stored in plain text. They are hashed by the managed authentication provider (bcrypt) and never touch application code or logs. ### 5. Multi factor authentication - Authenticator application (TOTP) multi factor authentication is available to all accounts and is mandatory for administrators. - The administration area is refused to any session that has not completed the authenticator step, verified server side against the session assurance level. - Enrolment shows a QR code and a one time recovery key which the account holder stores securely offline. - Security questions are not used at any point. ### 6. Administrator security - Administrator access requires password plus authenticator code. Password only access is not possible. - Role and assurance level are re checked on the server for every request that returns private information. Browser side checks are treated as presentation only. - Least privilege: administrators see waitlist entries, enquiries, notification records and the security log. No other private information exists on the platform. ### 7. Password reset - Reset links are issued by the managed authentication provider, are time limited and single use. - Passwords are never sent by email. - The reset request page returns an identical message whether or not an address is registered, so account existence is never disclosed. ### 8. Session security - Sessions use signed, short lived access tokens with automatic refresh. - Sign out clears the session, cancels in flight requests and clears cached data, and replaces the browser history entry so protected views cannot be restored. - Authentication tokens are never rendered into the page, logged, or exposed in URLs. - Service role credentials exist only in the server environment and are never present in browser code. ### 9. Form security Public forms: home resource sign up, join the circle waitlist, support guide sign up, and contact (general, support and partnership enquiries). - All submissions are validated on the server with a strict schema. Browser validation is convenience only. - Length limits are applied to every field. Script and event handler patterns are rejected in free text. - Direct database writes from the browser are disabled. Anonymous insert permission has been revoked; all writes pass through checked server code. - Rate limiting: a maximum of 10 submissions per hour per visitor and 5 per hour per email address, recorded in a private activity log. - A hidden honeypot field and a minimum time on page block simple automated abuse without adding any step for real visitors. - Data is parameterised throughout; injection is not possible through the data layer. ### 10. Notifications All sign ups, waitlist registrations, resource registrations, contact, support and partnership enquiries, plus administrative and security events, are directed to quietkindnessstudio@gmail.com. Every notification is recorded in a private outbox before sending, so nothing is lost, and each record is visible in the administration area. The recipient address is defined in a single place and can be changed in one step. Security events notified include administrator sign in, password change, authenticator enrolment or removal, and first administrator assignment. ### 11. Privacy and data minimisation - Collected: first name, email address, optional stage and optional contact number for waitlist entries; name, email, enquiry type and message for enquiries. - No health records, no clinical information, no payment data, no sensitive categories. - No submitted information is publicly readable. Row level security prevents any user from reading another person's submission. - Anonymous read access to subscriber and enquiry tables is revoked at the database level. ### 12. Testing Verified before release: sign up, sign in, sign out, password length and compromised password rejection, password reset link behaviour, authenticator enrolment and challenge, administrator refusal without the authenticator step, every public form, honeypot and timing rejection, rate limiting, unauthenticated and non administrator access attempts, and notification recording. ### 13. Change control This brief is reviewed whenever authentication, forms, notifications or access control change. Requests and questions: quietkindnessstudio@gmail.com.