Authentication And Access Policy
Last updated: August 21, 2026
Owner Access
The owner dashboard is protected by backend credentials stored in the private VPS environment file. Coolify deploys the app; it is not responsible for verifying clients or storing client passwords.
Client Access
Clients are created by the owner/admin inside the backend. The owner can search by client email and generate a temporary passcode for the private report link. After payment is confirmed, the system automatically creates client portal access and emails the temporary passcode and portal link to the client's email address.
First Login
Clients must enter their email and temporary passcode, then create a new password before their report opens. Passcodes are one-time and expire when changed. Passwords must be at least 8 characters.
Upload and Data Security
After login, clients can upload business files and notes in their portal. Uploaded files are stored securely in a private data directory on the VPS, and only the owner/admin and the client can see them. File text extraction is used to support report generation. Do not upload sensitive personal data such as Social Security numbers, payment card numbers, or medical records.
Session and Security
- Session cookies are HTTP-only and expire after a period of inactivity.
- We use HTTPS/secure connections (TLS) on the site.
- Provider settings and API keys remain private and are never exposed to clients.
- Access anomalies are logged and reviewed.