How users, administrators, engineers and machines are authenticated and what each can reach.
01Signing in to Mentornity
- Single sign-on: SAML 2.0 with the organisation’s identity provider, plus Sign in with Google and Sign in with Microsoft.
- Passwords are stored only as bcrypt hashes. New passwords must be at least 8 characters with upper-case, lower-case, a digit and a special character.
- Brute-force protection: repeated failed sign-ins temporarily lock further attempts, per account and per network address.
- No account enumeration: a wrong e-mail and a wrong password return the same answer in the same time.
- Session revocation: changing or resetting a password, or choosing “sign out everywhere”, invalidates every token issued before it, on every device.
- Signed links: invitation and e-mail action links carry an HMAC signature tied to their purpose, so a link cannot be reused for another account.
02Roles inside a programme
Access to programme data is decided on the server for every request. Participants see their own data, their matches and what the programme makes visible to them. Programme administrators see and manage their own programmes only; membership of the programme is checked on each administrative route, so an administrator of one programme cannot read another’s members, calendars or answers.
03Access to production
- Production access is limited to Mentornity’s executive management team and the engineers who operate the platform, and is reviewed whenever someone’s role changes.
- Administrative access to servers is key-based and audited; every administrative action in the cloud account is recorded in AWS CloudTrail. Password login to servers is disabled.
- Cloud permissions are split into narrowly scoped roles, each limited to the resources and the region its task needs.
- Database access uses separate least-privilege accounts per purpose; elevated access is granted only for a limited time and only when needed.
- Internal administration tools require multi-factor authentication.
04Machine identities
Servers reach cloud services through short-lived role credentials rather than stored keys. Public API clients authenticate with per-organisation API keys, each bound to one organisation and rate limited.
05Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.