Security and multi-factor authentication

Bancroft handles sensitive personal, financial, and legal information. Security is not an afterthought. This article covers how the platform protects data, how to set up multi-factor authentication, and what to do if something goes wrong. For the marketing-level overview written for compliance teams and procurement, see the security and compliance page.

Encryption

Data is encrypted in transit (TLS 1.3) and at rest:

• Database: hosted on Supabase PostgreSQL with encrypted storage volumes.
• Digital Safe files: AES-256-GCM envelope encryption with per-entry keys, each wrapped by a master key held outside the database. Even storage administrators cannot read vault files without the decryption keys managed by Bancroft.
• MFA secrets: encrypted with AES-256-GCM before storage. The encryption key is separate from the database encryption.
• Passwords: hashed with bcrypt (cost factor 10). Bancroft never stores plaintext passwords.

Setting up MFA

Multi-factor authentication adds a second layer of security beyond your password. Bancroft supports TOTP (Time-Based One-Time Password) using any authenticator app: Google Authenticator, Authy, 1Password, Microsoft Authenticator, or similar.

1. Go to Account Settings.
2. Click "Enable Two-Factor Authentication."
3. Scan the QR code with your authenticator app.
4. Enter the 6-digit code from the app to confirm setup.
5. Save your backup codes. These are one-time recovery codes in case you lose access to your authenticator app. Store them securely (password manager, printed sheet in a safe).

Session management

Sessions expire after 8 hours of inactivity. This is intentional and not configurable. When a session expires, the platform redirects you to the login page. Your work is not lost; the questionnaire autosaves, and any in-progress actions can be resumed after re-authentication.

Sessions are also revoked when:

• You change your password.
• You reset your password via the forgot-password flow.
• An admin changes your role.
• Your billing exemption is revoked.
• You are removed from a firm.

Session revocation is immediate and affects all active sessions for that user across all devices.

Rate limiting and lockout

All API endpoints are rate-limited to prevent abuse. Login attempts are limited to 5 failures before a temporary lockout. The lockout is per-account, not per-IP, so changing networks does not bypass it. Wait 15 minutes or use the forgot-password flow to reset.

Write operations (creating documents, updating answers, uploading files) have per-user rate limits to prevent automated abuse. Normal usage never hits these limits. If you see a "too many requests" error, wait a moment and try again.

Row-level security

The database uses row-level security (RLS) policies on all tables containing user data. This means that even if an application-layer bug were to bypass authorization checks, the database itself enforces that users can only access rows they are authorized to see. RLS is a defense-in-depth measure, not a replacement for application-layer authorization.

What to do if you suspect unauthorized access

1. Change your password immediately from Account Settings.
2. This automatically revokes all active sessions across all devices.
3. Check your recent activity for any actions you do not recognize.
4. If MFA is not enabled, enable it now.
5. Contact support@usebancroft.com with details. We can investigate login history and take additional protective measures.