Account security is built around four things: passwords, two-factor authentication, password recovery, and session management. After the password, staff and trainers are asked for a six-digit code from an authenticator app or by email (see Two-factor authentication). SSO is on the roadmap.
Passwords
- Minimum length: 8 characters. There is no maximum.
- Complexity requirements: none beyond the minimum length. The platform does not enforce a mix of cases, numbers, or symbols. Pass-phrase-style passwords (long, easy to remember) are encouraged over short complex ones.
- Storage: hashed with bcrypt at cost 12. The plain-text password is not stored, not logged, not recoverable.
A password manager (1Password, Bitwarden, Apple Keychain, browser-built-in) is the simplest defence against weak or reused passwords. The platform does not require a specific manager; any standard one works.
Changing your password
From your profile:
/{slug}/me/profile → Change password. Three fields: current, new, confirm new. The current password is required even if you are already signed in.
Changing your password keeps you signed in on this device but signs you out on every other device where you were previously signed in.
Recovering a lost password
If you cannot sign in:
/login → Forgot your password? → enter your email → check your inbox.
The full flow is described in Forgot your password?. The token is valid for one hour; rate-limited to three requests per hour per email.
If recovery does not work (email not arriving, link expired several times), write to hello@jadiroon.sa. We can verify your identity and issue a manual reset.
Sessions
A session is created when you sign in. The session is held as a signed JWT in a secure cookie. Session lifetime is 30 days; after that you are signed out and must sign in again.
Changing your password signs you out everywhere else. Your trusted devices are listed on your profile:
/{slug}/me/profile (or /{slug}/app/profile) → Two-step verification card → Trusted devices.
From here you can:
- Revoke one trusted browser, so it asks for a code again.
- Revoke all, which forgets every trusted browser and also signs you out of your other sessions.
If you suspect your account is compromised, change your password and revoke all trusted devices. If the suspicion is strong, write to hello@jadiroon.sa and we will investigate the audit logs for the period.
Two-factor authentication
After the password, staff and trainers can be asked for a six-digit code from an authenticator app or from an email. No session exists until the code is accepted. Candidates are never asked for a code.
- HR administrators always use two-factor, whatever the workspace setting.
- Other staff and trainers use it when the workspace requires it (on by default), or when they turned it on themselves. See Requiring two-factor for your workspace.
- Trust this device for 30 days skips the code on a browser you own. Changing or resetting your password, an administrator reset of your two-factor, or revoking the device ends that trust.
- Platform super admins always enter an authenticator-app code at the console login, with no trusted-device option.
Account lockout
- Password step: the platform does not lock accounts on wrong passwords. Failed attempts are rate-limited per IP address to slow down brute-force attempts, but there is no count-then-lock policy, since lockouts are a denial-of-service vector against legitimate users.
- Code step: five wrong codes cancel the sign-in attempt, and the account owner receives an email that wrong codes were entered. After 20 wrong codes in an hour, code sign-in for that account is paused for the hour ("Too many wrong codes. Try again in an hour."). A browser already trusted for the account still signs in.
If you are locked out of two-factor entirely (lost phone, no email), your HR administrator can reset it. If you suspect targeted brute-force activity against your account, write to hello@jadiroon.sa.
What is on the roadmap
- SSO: SAML and OIDC integration for organisations that prefer central identity management.
- WebAuthn / passkeys: phishing-resistant authentication.
- Configurable session lifetime per workspace.
- IP allowlist for HR Administrator access (organisation-policy enforcement).
Workspaces with strict authentication requirements can write to hello@jadiroon.sa to coordinate; some of these capabilities may be pulled forward for specific customers.
What you can do today
- Use a password manager.
- Use a unique password for Jadiroon — not one you reuse from other accounts.
- Set up an authenticator app rather than email codes, and keep it on a phone you control.
- Sign out of shared or public devices before walking away.
- Review your trusted devices every few months.