How sign-in and access are protected

Invitations only, links that work once, wrong passwords that wait, each shop's work kept apart, and records that cannot be rewritten.

This is what Studio Cloud does today to keep your shop's work to your shop's people. It says only what is built.

Who can get in

  • Invitations only. Nobody makes an account for themselves. A supervisor invites each person by e-mail. The invitation link is long and random, is kept as a hash, works once and ends after seven days. An address that already has another kind of account with us cannot be invited.
  • A person's own password. They choose it from the invitation. Passwords are never shown or sent.
  • Wrong passwords wait, they do not lock. Three wrong passwords for an address are free, then each wait starts at 15 seconds and doubles up to 15 minutes. A right password has to wait out the wait too. Nobody is locked out for good.
  • It never says who has an account. Forgot your password? answers the same way whether or not the address has an account. If it does, the e-mail carries a link that works once and lasts an hour.
  • Signing out is everywhere. Signing out on one computer signs you out of every computer, so a copied session stops working at once.
  • A removed person is turned away at every request. Removal, or a licence that has ended, is checked on every request and not only at sign-in.

Which shop you are in

A signed-in person is in one shop. Every request is judged for that shop only. A job, press, person or roll that belongs to another shop is not found, and a shop's lists are read only by that shop's own people.

What cannot be rewritten

  • Every save of a job is kept. The record of saves refuses to be changed or deleted, so nothing can rewrite a job's history. Going back to an earlier save is a new save.
  • A proof link's answers are kept as lines that nothing can change or remove: approving twice is two lines.
  • Nothing is deleted when a person or a licence goes. A removed person is marked; a lapsed licence leaves Studio read-only.
  • The link carries a random token that is shown to you once. Only its fingerprint is kept.
  • It ends after the days you chose, and you or any supervisor can end it sooner.
  • The customer sees one picture, your shop's name, the job's name, your note and the answers on that link. Never another job, an order number or a person's details.
  • The page sets no cookie, is not shown by search engines, and the address is kept out of the site's page counts. What a customer types is shown as text, never run as code.

Secrets

  • The ONYX Sync vendor code you type into Integrations is kept sealed. Studio shows only its last four characters and never sends it back.
  • A press connector's permission is a token of its own that opens only its own site's doors. It is kept only as a hash, and a supervisor can disconnect it at any time.
  • A pairing code works once and ends after 15 minutes.

What a lapsed licence does

Everything that changes something is refused, in words that say why. Reading and taking your work out still work, as does ending somebody's access.

How sign-in and access are protected | Postpress