Login Security
Secure Authentication
Kaana uses Auth0, an industry-leading authentication platform:
Enterprise-grade security
Regular security audits
Compliance certifications
Password Requirements
Strong passwords are required:
Minimum 8 characters
Mix of letters, numbers, and symbols recommended
Common passwords blocked
Breach detection (warns if password found in data breaches)
Password Storage
Your password is never stored in plain text:
Hashed using secure algorithms
Salted to prevent rainbow table attacks
We cannot see or retrieve your password
Session Security
How Sessions Work
When you log in:
Secure session created
HTTP-only cookie set (not accessible to JavaScript)
Session validated on each request
Automatic timeout after inactivity
Session Features
Feature | Description |
HTTP-Only Cookies | Prevents XSS attacks |
Secure Flag | Only sent over HTTPS |
Session Timeout | Auto-logout after inactivity |
Single Session | Option to log out other sessions |
Account Protection
Failed Login Protection
Account temporarily locked after multiple failed attempts
Prevents brute-force attacks
Automatic unlock after cooldown period
Suspicious Activity
We monitor for:
Unusual login locations
Multiple failed attempts
Abnormal access patterns
Email Verification
Email addresses verified on signup
Notifications for account changes
Password reset requires email access
Password Reset
Secure Reset Process
Request reset from login page
Email sent with secure link
Link expires after limited time
Must create new password
All sessions invalidated
Tips for Safe Reset
Only request resets from official Kaana login page
Check email sender is legitimate
Never share reset links
Use a strong new password
Protecting Your Account
Best Practices
Use a strong, unique password
Don't reuse passwords from other sites
Consider a password manager
Keep your email secure
Your email is used for password resets
Secure your email account
Log out on shared devices
Always log out when using shared computers
Don't save password in public browsers
Watch for phishing
Verify URLs before entering credentials
We'll never ask for your password via email
Signs of Compromise
Watch for:
Login notifications you didn't initiate
Password reset emails you didn't request
Unfamiliar activity in your account
Settings changes you didn't make
If you notice these, change your password immediately and contact support.
Administrator Controls
For account administrators:
User Management
Invite and remove users
Set role-based permissions
Monitor user activity
Security Settings
Enforce password policies
Review access logs
Manage API keys
Deactivating Users
Immediately revoke access
Block future login attempts
Preserve data for audit
Logging Out
How to Log Out
Click your profile menu
Select "Log Out"
Session is terminated
Redirected to login page
Automatic Logout
Sessions expire after a period of inactivity for security.