Security Guide

Security best practices for configuring Autional in production environments.

MFA Configuration

Autional supports 5 MFA methods, configurable per tenant:

Adaptive MFA (Risk Engine)

The adaptive MFA engine evaluates 10 signal categories to determine authentication risk:

• IP risk— risk scoring based on the source IP
• Login failure rate— detection of repeated failures within a short window
• New device— first-seen device fingerprint
• Location— geolocation risk assessment
• Unusual time— sign-ins outside normal activity hours
• New country— first-seen country/region
• Velocity anomaly— impossible-travel detection
• Credential leak— breached password detection (HIBP)
• MFA method change— change detection for MFA methods
• Session hijacking— session hijack detection

Password Policy

Per-tenant configurable password policies:

• Minimum/maximum length, complexity rules (upper, lower, digit, special)
• Password history (the most recent N passwords cannot be reused)
• Expiry (configurable days, forced reset on expiry)
• Breach detection (HIBP database check)
• Account lockout (threshold + lock duration)

Encryption at Rest

Field-level AES-256-GCM encryption with key rotation support; SM4-GCM for national cryptography compliance.

Audit Trail

All authentication events are recorded in an immutable Merkle hash chain audit log, with cryptographic verification for tamper-proof integrity.