Skip to main content

Security Settings

Overview​

CADENSA provides enterprise-grade security features to protect your data. Configure two-factor authentication, manage sessions, set up SSO (ENTERPRISE) (Coming Soon), and review audit logs.

Security features:

  • Two-Factor Authentication (2FA)
  • 🔑 Single Sign-On (SSO) - ENTERPRISE (Coming Soon)
  • Audit Logs - ENTERPRISE
  • 🛡️ IP Allowlisting - ENTERPRISE
  • Session Management
  • ⚡ Security Alerts

Two-Factor Authentication (2FA)​

Enable 2FA​

Add extra security to your account.

(Covered in detail in Profile Settings)

Quick setup:

  1. Settings → Security → 2FA
  2. Choose method (Authenticator app recommended)
  3. Scan QR code with app
  4. Verify 6-digit code
  5. Save backup codes
  6. 2FA enabled

2FA methods:

  • Authenticator App (Recommended) - Google Authenticator, Authy, 1Password
  • SMS - Text message to phone number
  • Email - Code sent to email (least secure)

Enforce 2FA (ENTERPRISE)​

Require 2FA for all workspace members.

How to enforce:

  1. Navigate to Workspace Settings → Security
  2. Click "Enforce 2FA"
  3. Set grace period
  4. Notify team members
  5. Enable enforcement

2FA enforcement settings:

┌─────────────────────────────────────────┐ │ Two-Factor Authentication Policy │ │ (ENTERPRISE Workspace Setting) │ ├─────────────────────────────────────────┤ │ │ │ ☑ Require 2FA for all members │ │ │ │ Enforcement Level: │ │ ● Mandatory (block access) │ │ ○ Recommended (warning only) │ │ │ │ Grace Period: │ │ [7 days ▼] │ │ │ │ Users without 2FA: 3 │ │ • John Doe (Owner) │ │ • Sarah Johnson (Manager) │ │ • Mike Chen (Member) [Remind] │ │ • Lisa Park (Member) [Remind] │ │ • Tom Wilson (Viewer) [Remind] │ │ │ │ Notification: │ │ ☑ Email users without 2FA │ │ ☑ Show banner on login │ │ │ │ Allowed Methods: │ │ ☑ Authenticator app │ │ ☑ SMS │ │ ☐ Email (not recommended) │ │ │ │ [Send Reminder] [Enable Enforcement] │ └─────────────────────────────────────────┘

Grace period enforcement:

Day 1: Enable enforcement
- Email sent to users without 2FA
- Banner shown on login
- "You have 7 days to enable 2FA"

Days 2-6: Reminders
- Daily reminder banner
- Email reminder at Day 4

Day 7: Enforcement begins
- Users without 2FA blocked
- Must enable 2FA to access account
- Can still receive password reset emails

Single Sign-On (SSO)​

Coming Soon — ENTERPRISE

SSO (SAML 2.0) and LDAP / Active Directory integration are planned for a future release. This section describes the planned functionality. SSO is not yet available in CADENSA — see the Roadmap for the expected timeline.

SAML 2.0 Integration (ENTERPRISE)​

Enterprise SSO for centralized authentication.

Supported providers:

  • Microsoft Azure AD / Entra ID
  • Okta
  • Google Workspace
  • OneLogin
  • Auth0
  • Ping Identity
  • ADFS
  • Custom SAML 2.0 providers

Setup process:

Step 1: Request SSO

1. Contact CADENSA support: <a data-action="support" href="#">support@cadensa.io</a>
2. Provide:
 - Identity Provider (IdP) name
 - SAML metadata URL or XML file
 - Technical contact info
3. Support creates SSO configuration
4. You receive CADENSA SAML details

Step 2: Configure IdP

Add CADENSA to your Identity Provider:

Service Provider Details:
- Entity ID: https://app.cadensa.io/saml/metadata
- ACS URL: https://app.cadensa.io/saml/acs
- SLS URL: https://app.cadensa.io/saml/sls

Attribute Mapping:
- Email: email, emailAddress, mail
- First Name: firstName, givenName
- Last Name: lastName, surname, sn
- Display Name: displayName (optional)

Step 3: Test & Enable

  1. CADENSA support configures connection
  2. Test login provided
  3. Verify user attributes
  4. Enable for workspace
  5. Users login via SSO

SSO configuration:

┌─────────────────────────────────────────┐ │ Single Sign-On Configuration │ │ (ENTERPRISE) │ ├─────────────────────────────────────────┤ │ │ │ SSO Status: Enabled │ │ │ │ Identity Provider: │ │ Microsoft Azure AD │ │ │ │ Connection Details: │ │ • Entity ID: https://sts.windows.net/../│ │ • SSO URL: https://login.microsoftonline│ │ .com/.../saml2 │ │ • Certificate: Valid until Dec 2027 │ │ │ │ Attribute Mapping: │ │ Email: emailaddress │ │ First Name: givenname │ │ Last Name: surname │ │ Display Name: displayname │ │ │ │ User Provisioning: │ │ ● Just-In-Time (JIT) │ │ (Create user on first login) │ │ ○ Manual only │ │ │ │ Default Role for New Users: │ │ [Member ▼] │ │ │ │ Fallback Authentication: │ │ ☑ Allow password login for admins │ │ (Emergency access) │ │ │ │ [Test SSO] [Disable SSO] [Edit] │ └─────────────────────────────────────────┘

LDAP / Active Directory (ENTERPRISE)​

Direct integration with corporate directory.

Setup:

┌─────────────────────────────────────────┐
│ LDAP / Active Directory Integration     │
│ (ENTERPRISE)                            │
├─────────────────────────────────────────┤
│                                         │
│ Server Settings:                        │
│ Host: [ldap.company.com__________]      │
│ Port: [389] ☐ Use SSL (636)             │
│                                         │
│ Bind Credentials:                       │
│ Bind DN: [cn=admin,dc=company,dc=com_]  │
│ Password: [•••••••••]                   │
│                                         │
│ User Search:                            │
│ Base DN: [ou=users,dc=company,dc=com_]  │
│ Filter: [(objectClass=person)_______]   │
│                                         │
│ Attribute Mapping:                      │
│ Email: [mail____________]               │
│ First Name: [givenName______]           │
│ Last Name: [sn____________]             │
│ Username: [sAMAccountName_]             │
│                                         │
│ Group Sync (optional):                  │
│ ☑ Sync LDAP groups to CADENSA           │
│ Admin Group: [CN=CADENSA_Admins____]    │
│ Manager Group: [CN=CADENSA_Managers_]   │
│                                         │
│ [Test Connection] [Save Configuration]  │
└─────────────────────────────────────────┘

Audit Logs​

Security & Activity Logs (ENTERPRISE)​

Track all account activity for compliance.

What's logged:

Authentication Events:

  • User login (success/failure)
  • User logout
  • Password changes
  • 2FA enabled/disabled
  • SSO logins
  • Failed login attempts

Account Changes:

  • User created/deleted
  • Email changed
  • Role changed
  • Permission changes
  • Workspace access granted/revoked

Data Access:

  • Project created/edited/deleted
  • Time entries created/edited/deleted
  • Report generated
  • Data exported
  • Settings changed

Billing:

  • Subscription upgraded/downgraded
  • Payment method added/removed
  • Invoice generated

Audit log viewer:

┌─────────────────────────────────────────┐
│ Audit Logs                              │
│ [Export CSV] [Filter ▼] [Search____]    │
├─────────────────────────────────────────┤
│                                         │
│ Timestamp User Action                   │
│ ────────────────── ───────── ────────── │
│                                         │
│ 2026-01-25 10:45 John Doe LOGIN         │
│ IP: 185.123.45.67                       │
│ Device: Chrome on macOS                 │
│ Location: Budapest, HU                  │
│ [View Details]                          │
│                                         │
│ 2026-01-25 10:30 Sarah J. EDITED        │
│ Project: Website Redesign               │
│ Changed: Budget 80h → 100h              │
│ [View Details]                          │
│                                         │
│ 2026-01-25 10:15 Mike C. EXPORTED       │
│ Report: Monthly Time Report             │
│ Format: CSV                             │
│ Rows: 1,234 entries                     │
│ [View Details]                          │
│                                         │
│ 2026-01-25 09:58 System FAILED          │
│ Login attempt failed                    │
│ User: john.doe@example.com              │
│ Reason: Invalid password                │
│ IP: 192.168.1.100                       │
│ [View Details]                          │
│                                         │
│ 2026-01-25 09:45 Lisa P. CREATED        │
│ Time Entry: 2h 30m                      │
│ Project: Mobile App                     │
│ Task: Bug fixes                         │
│ [View Details]                          │
│                                         │
│ [Load More] [Jump to Date...]           │
└─────────────────────────────────────────┘

Filter audit logs:

┌─────────────────────────────────────────┐
│ Filter Audit Logs                       │
├─────────────────────────────────────────┤
│                                         │
│ Date Range:                             │
│ From: [2026-01-01_] To: [2026-01-31_]   │
│                                         │
│ Event Type:                             │
│ ☐ All Events                            │
│ ☑ Authentication (login/logout)         │
│ ☑ User management                       │
│ ☐ Project changes                       │
│ ☐ Time entries                          │
│ ☑ Data exports                          │
│ ☑ Settings changes                      │
│ ☑ Billing events                        │
│ ☑ Security alerts                       │
│                                         │
│ User:                                   │
│ [All Users ▼] or [Search user...]       │
│                                         │
│ IP Address:                             │
│ [_______________] (optional)            │
│                                         │
│ Result:                                 │
│ ○ All                                   │
│ ○ Success only                          │
│ ● Failed only                           │
│                                         │
│ [Clear Filters] [Apply Filters]         │
└─────────────────────────────────────────┘

Export audit logs:

Export Format:
● CSV (Excel-compatible)
○ JSON (machine-readable)
○ PDF (human-readable)

Date Range: Last 90 days
Events: 12,345 matching events

Columns to include:
☑ Timestamp
☑ User
☑ Event Type
☑ IP Address
☑ Device/Browser
☑ Location
☑ Details
☑ Result (Success/Failed)

[Cancel] [Export Audit Log]

IP Allowlisting (ENTERPRISE)​

Restrict Access by IP​

Only allow access from specific IP addresses.

Use cases:

  • Office-only access
  • VPN-required access
  • Geographic restrictions
  • Compliance requirements

IP allowlist configuration:

┌─────────────────────────────────────────┐ │ IP Allowlisting │ │ (ENTERPRISE) │ ├─────────────────────────────────────────┤ │ │ │ ☑ Enable IP allowlisting │ │ │ │ Warning: This will block access │ │ from IPs not on the list. │ │ │ │ Allowed IP Addresses: │ │ │ │ ┌────────────────────────────────────┐ │ │ │ 185.123.45.0/24 │ │ │ │ Description: Budapest Office │ │ │ │ [Edit] [Remove] │ │ │ └────────────────────────────────────┘ │ │ │ │ ┌────────────────────────────────────┐ │ │ │ 78.234.56.100 │ │ │ │ Description: Remote VPN │ │ │ │ [Edit] [Remove] │ │ │ └────────────────────────────────────┘ │ │ │ │ ┌────────────────────────────────────┐ │ │ │ 192.168.1.0/24 │ │ │ │ Description: Local Network │ │ │ │ [Edit] [Remove] │ │ │ └────────────────────────────────────┘ │ │ │ │ [+ Add IP Address/Range] │ │ │ │ Bypass Options: │ │ ☑ Allow API access (for integrations) │ │ ☐ Allow mobile apps │ │ ☑ Allow admins (emergency access) │ │ │ │ Current IP: 185.123.45.67 │ │ Status: Allowed │ │ │ │ [Save Settings] │ └─────────────────────────────────────────┘

Add IP address:

┌─────────────────────────────────────────┐
│ Add IP Address or Range                 │
├─────────────────────────────────────────┤
│                                         │
│ Type:                                   │
│ ● Single IP (192.168.1.100)             │
│ ○ IP Range (CIDR notation)              │
│                                         │
│ IP Address:                             │
│ [185.123.45.67______________]           │
│                                         │
│ Or IP Range (CIDR):                     │
│ [185.123.45.0/24____________]           │
│                                         │
│ Description:                            │
│ [Office Network_____________]           │
│                                         │
│ [Cancel] [Add to Allowlist]             │
└─────────────────────────────────────────┘

Session Management​

Active Sessions​

(Covered in Profile Settings)

Quick actions:

  • View all active sessions
  • See device, location, IP
  • Logout individual sessions
  • Logout all other sessions

Remember Me & New Tab Behavior​

Understanding how login sessions work across browser tabs.

When you log in to CADENSA, you choose how your session is stored:

Login optionSession storageNew tab behavior
✅ Remember me checkedlocalStorage (persists across tabs)Opens directly to dashboard
☐ Remember me uncheckedsessionStorage (tab-only)Redirects to login page
Why does a new tab redirect to login?

This is intentional security behavior. When you log in without "Remember me", your session is tied to that specific browser tab. Opening a new tab starts a fresh, unauthenticated session — your credentials are never shared between tabs.

This protects you on shared computers: closing the tab ends your session completely.

Want to stay logged in across tabs?

Enable the "Remember me" checkbox on the login page. Your session will persist across all tabs and browser restarts until you explicitly log out or the token expires (24 hours).

What to do if you're always redirected to login on new tabs:

  1. Log out completely
  2. Log back in with "Remember me" checked
  3. New tabs will now open directly to your dashboard

Session Security Settings​

Configure session behavior.

┌─────────────────────────────────────────┐
│ Session Security                        │
├─────────────────────────────────────────┤
│                                         │
│ Session Timeout:                        │
│ [7 days ▼]                              │
│                                         │
│ Idle Timeout:                           │
│ [30 minutes ▼]                          │
│ (Logout after 30 min of inactivity)     │
│                                         │
│ Concurrent Sessions:                    │
│ ● Unlimited                             │
│ ○ Single device only                    │
│ ○ Maximum: [3] devices                  │
│                                         │
│ Remember Device:                        │
│ ☑ Remember this device for 30 days      │
│ (Skip 2FA on trusted devices)           │
│                                         │
│ Security Notifications:                 │
│ ☑ Email on new device login             │
│ ☑ Email on suspicious activity          │
│ ☑ Email on password change              │
│                                         │
│ [Save Settings]                         │
└─────────────────────────────────────────┘

Security Alerts​

Suspicious Activity Detection​

Automatic security monitoring.

What's monitored:

  • Multiple failed login attempts
  • Login from unusual location
  • Login from new device
  • Large data exports
  • Unusual API activity
  • Permission changes

Security alert example:

From: CADENSA Security <a data-action="support" href="#">support@cadensa.io</a>
To: john.doe@example.com
Subject: Security Alert: New Device Login

Dear John,

We detected a login to your CADENSA account from
a new device:

Device: Chrome on Windows
Location: London, United Kingdom
IP Address: 78.234.56.78
Time: Jan 25, 2026 at 10:45 GMT

Was this you?

[Yes, this was me] [No, secure my account]

If this wasn't you:
1. Change your password immediately
2. Enable 2FA if not already enabled
3. Review active sessions
4. Contact support if needed

Best regards,
CADENSA Security Team

Security dashboard:

┌─────────────────────────────────────────┐ │ Security Overview │ ├─────────────────────────────────────────┤ │ │ │ Account Security Score: 85/100 │ │ │ │ Recommendations Completed: │ │ • Strong password (12+ chars) │ │ • 2FA enabled │ │ • Recent security review │ │ │ │ Recommendations: │ │ • Review active sessions (5 devices) │ │ • Update password (last changed 90d) │ │ │ │ Recent Security Events: │ │ • Login from new device (2 hours ago) │ │ • Password changed (15 days ago) │ │ • 2FA enabled (30 days ago) │ │ │ │ [View All Security Events] │ └─────────────────────────────────────────┘

Compliance & Certifications​

SOC 2 Type II (ENTERPRISE)​

CADENSA compliance certifications.

Available certifications:

SOC 2 Type II

  • Annual audit
  • Security, availability, confidentiality
  • Report available on request

GDPR Compliant

  • Data processing agreements
  • Right to deletion
  • Data portability
  • Privacy by design

ISO 27001 (in progress)

  • Information security management
  • Expected: Q2 2026

HIPAA Compliant (ENTERPRISE add-on)

  • Healthcare data protection
  • Business Associate Agreement
  • Contact sales for details

Request compliance documents:

1. Email: <a data-action="support" href="#">support@cadensa.io</a>
2. Specify:
 - Company name
 - Certification needed
 - Purpose (vendor assessment, audit, etc.)
3. Receive:
 - SOC 2 report
 - DPA (Data Processing Agreement)
 - Security questionnaire responses
 - Penetration test summaries

Data Encryption​

Encryption Details​

How CADENSA protects your data.

Encryption at rest:

AES-256 encryption Database encrypted Backups encrypted File storage encrypted (S3)

Encryption in transit:

TLS 1.3 (minimum TLS 1.2) Perfect Forward Secrecy HSTS enabled Certificate pinning (mobile apps)

Key management:

AWS KMS (Key Management Service) Automatic key rotation Separate keys per customer (ENTERPRISE)

Best Practices​

Do's​

  • Enable 2FA - Extra security layer
  • Use strong passwords - 12+ characters, unique
  • Review active sessions - Logout unknown devices
  • Monitor audit logs - Check for suspicious activity (ENTERPRISE)
  • Restrict IP access - If possible (ENTERPRISE)
  • Use SSO (Coming Soon) - Centralized authentication (ENTERPRISE)
  • Regular security reviews - Quarterly minimum
  • Educate team - Security awareness training

Don'ts​

  • Don't share passwords - Each user has own account
  • Don't ignore security alerts - Investigate all warnings
  • Don't disable 2FA - Unless absolutely necessary
  • Don't use public WiFi - Without VPN
  • Don't share API keys - Revoke and regenerate if leaked
  • Don't skip compliance - Legal requirements

Troubleshooting​

Can't login with SSO (Coming Soon)​

Problem: SSO login not working.

Solutions:

  1. Check with IT admin (IdP configuration)
  2. Verify user exists in IdP
  3. Check email attribute mapping
  4. Use emergency password login (if enabled)
  5. Contact CADENSA support

2FA code not working​

Problem: 6-digit code rejected.

Solutions:

  1. Ensure time sync on device (settings → date/time)
  2. Wait for new code (refresh every 30 seconds)
  3. Use backup code instead
  4. Contact support to disable 2FA temporarily

IP blocked​

Problem: Cannot access from current IP.

Solutions:

  1. Check current IP: whatismyipaddress.com
  2. Contact workspace admin to add IP
  3. Use VPN if configured
  4. Use mobile data as temporary workaround
  5. Admin emergency access

Next Steps​

Need Help?​