Identity & Security

One identity. Every surface.

A dedicated authentication service sits at the center of the platform. It issues a single signed token that Manager, Loan Pricer, Bulk Pricer, the Mobile app, and the API all trust — so a user signs in once and moves across every product without a second login, under one consistent security boundary.

Single sign-on Two-factor authentication Stateless 2FA Role-aware claims

Authenticate once. Trusted everywhere.

The same token carries the user's roles and capabilities to every product.

1
Sign in
Credentials + 2FA
→
2
Token issued
Signed JWT with role claims
→
3
Trusted everywhere
Every product validates it
ManagerLoan Pricer Bulk PricerMobileAPI
5
surfaces, one identity
web, mobile & the API
1
security boundary
to audit
0
server-side stores
for two-factor state
49
identity unit tests,
CI-gated

The security model, in brief

Single sign-on
One account spans the whole platform; the token issued at login is honored by every product and the API.
Stateless two-factor
A short-lived signed pre-auth token carries the "verified, awaiting code" state between steps — so 2FA works identically on web and mobile with no server-side session store. One-time codes are hashed at rest, with SMS-to-email fallback.
Per-session refresh rotation
Each session carries its own refresh token, and refreshing rotates only the token presented — so concurrent devices never sign each other out, with no shared, reusable credential.
Account lifecycle
Registration, admin approval, and activation flows are first-class — not afterthoughts bolted onto login.
No account enumeration
Sign-in, password-recovery, and registration responses are deliberately generic — they never confirm whether an account exists.
Hashed, single-use tokens
Password-reset and activation links are cryptographically random, stored only as a hash, time-boxed, and consumed on first use.
Rate-limited by design
Abuse-prone endpoints — sign-in, recovery, two-factor resend — are rate-limited per source.
Anti-phishing recovery
Credential recovery presents a company challenge — your real company among decoys — before any reset is sent.

A clean security boundary

One place to reason about authentication for the whole system.

Stateless, token-based

Authentication is a standalone, stateless service; products are callers that validate a signed token rather than holding their own user stores. That keeps the security surface small and consistent across web, mobile, and API.

Claims carry capability

The token carries the user's roles and product capabilities, so each service can enforce access from the claims it already holds — the same role model that governs Manager applies everywhere.

One boundary to audit

Because login, two-factor, refresh, and account lifecycle live in one service, a security reviewer has a single, well-defined surface to assess — not authentication logic scattered across five products. Sign-in, sign-out, timeout, and exception events are written to an access-audit trail, so who reached what, and when, is traceable after the fact.

One login. The whole platform.

A consistent, reviewable security boundary across every product.

Request Private Access