Access and roles
Signing in
Section titled “Signing in”- Passwords are stored only as salted hashes.
- Two-factor authentication with an authenticator app is available to every user, with recovery codes.
- Short-lived sessions. Session credentials are short-lived and held in HttpOnly cookies. Longer-lived refresh credentials rotate on use, within a family for each device.
- Rate limits. Sign-in and two-factor attempts are rate-limited.
- Approval for new accounts. A new self-signup stays pending until it is approved.
Ending sessions
Section titled “Ending sessions”- Users can list their sessions, end any one, or sign out everywhere.
- Changing a password ends the user’s other sessions.
- Suspending or removing a member, or deactivating an organization, ends the affected sessions.
Roles in an organization
Section titled “Roles in an organization”Authorization is default-deny: a person can do only what a role grants.
| Role | Can |
|---|---|
| Organization admin | Manage members and settings, and everything a member can do |
| Member | Search, build, run audience groups, package campaigns and export |
| View-only | Read the workspace and reports. Cannot export. |
Moonbrush platform administrators are a separate role, and their entries into a client workspace are logged.
Agency access
Section titled “Agency access”An agency works in a client’s workspace through a scoped, revocable link. The scope sets what the agency may do: view, activate campaigns, or bring in results. Scope is enforced on the server, and changing or revoking it ends the affected sessions.
Audit logging
Section titled “Audit logging”| Logged | Detail |
|---|---|
| Authentication | Sign-ins and failures, sign-outs, session refreshes, password resets |
| People | Member lifecycle changes and organization switches |
| Agency access | Every change to an agency link, with the scope before and after, the IP address, user agent and delegating agency |
| Moonbrush staff | Each entry by Moonbrush staff into a client workspace |
| Exports | A send record for every package and export |