Security and architecture
MFA Portal handles authentication events, not application data. This page describes exactly what passes through the service and what does not.
What we store
- Directory identifiers: user object ID, email address, display name, group membership.
- Enrolled authenticators per user: WebAuthn public keys, TOTP seeds, device labels and enrolment dates. Seeds and keys are encrypted with AES-256-GCM under keys held in AWS KMS, rotated annually.
- Administrator accounts, roles and scopes for the console.
- Audit events: authentication and recovery attempts with timestamp, method, result, IP and user agent.
What we never receive: your users’ password hashes, the contents of your applications, mailbox or file data, and any client agent on user devices. The password check stays with your identity provider; we only decide whether the second step was satisfied.
Regions and hosting
Each tenant is provisioned in one region, chosen at setup: eu-central-1 (Frankfurt) or us-east-1 (Virginia). Tenants are logically separated and data is not replicated across regions. Backups remain in the tenant region.
Encryption
- TLS 1.3 on the authentication endpoints and the console; TLS 1.2 minimum, older versions refused.
- AES-256 at rest for the database and object storage, with KMS-managed keys.
- Certificate pinning supported for the mobile app; mTLS offered on the Enterprise relay.
Administrator controls
- WebAuthn is required for all administrator accounts; SMS is never permitted for a privileged role.
- Role-based scopes: helpdesk staff can reset enrolment without seeing audit exports.
- Console sign-ins are logged with IP and user agent, and a new admin sign-in notifies the previous administrators.
- Break-glass accounts are named individually, excluded from policy in writing, and reported separately each month.
Assurance
- SOC 2 Type II, audited annually; report available under NDA.
- Third-party penetration test of the console, API and mobile app each year; summary letter on request.
- Availability 99.97% trailing 12 months, measured at the authentication endpoint.
- Dependency and vulnerability review in each release; critical patches applied within 72 hours.
Sub-processors
| Provider | Purpose | Location |
|---|
| Amazon Web Services | Hosting, KMS, backups | Tenant region (eu-central-1 or us-east-1) |
| Mailgun Technologies | Enrolment invitations and account notices | United States / European Union |
| Twilio | SMS fallback codes, where a tenant enables it | United States |
| Datadog | Service monitoring and error tracking | United States |
Sub-processors are listed in the privacy policy. Tenants are notified 30 days before a new one is engaged.
Deletion and export
Closing a tenant exports what you ask for (users, enrolment status, audit events as JSON or CSV) and deletes the rest within 30 days, with a written confirmation. Individual users removed from the directory are deleted at the next sync.
Security contact. [email protected]. Reports from client security teams are answered by the on-call engineer, and confirmed vulnerabilities are disclosed to affected tenants once a fix is available.