Sign-in protection & audit trail

Account lockout

Five failed password attempts lock an account for fifteen minutes.

There is a second sign-in surface with different behaviour, and the difference is deliberate:

The shared multi-store sign-in address does not run the lock counter

CIQRA has one shared sign-in address that can reach several stores. If that address incremented a lock counter, a stranger who knew an email could lock five merchants out at once by failing on purpose — turning a protection into a denial-of-service tool.

So on that surface the counter is not written. Two things still hold: rate limiting applies there, with tighter ceilings than the per-store sign-in, and an existing lock is still honoured — an account already locked cannot sign in through it.

Two-step verification (2FA)

Available per user. Anyone with a CIQRA sign-in can enable two-step verification on their own account.

There is no store-level policy that makes it mandatory for a whole team. A store owner cannot currently require 2FA of every staff member; each person switches it on for themselves. That policy does not exist in 1.0, and we would rather write that plainly than let “2FA supported” imply enforcement.

What is recorded

The honest answer has two halves, and both belong in the same sentence: CIQRA’s own operator console records sign-in activity in full, and the merchant admin does not.

Surface	Recorded
CIQRA operator console	Yes — failed sign-in (unknown address), failed sign-in (wrong password), blocked sign-in (suspended), successful sign-in, and sign-out, each with the actor and the originating IP address
Merchant admin	No — sign-in and sign-out on the merchant-facing admin do not produce audit events

The second row is a deliberate exclusion, not an omission. The identity and token paths are kept out of the audit middleware on purpose, so that the component which records events never sits in the path that handles credentials.

One more limit worth knowing

Auditing covers actions that change something. A read — opening a page, viewing a record — does not produce an audit event anywhere. If you need “who looked at this”, that is not a question this trail can answer today.

What this page does not say

• It does not claim tenant-level enforced 2FA. It does not exist.
• It does not claim merchant-admin sign-in auditing. It is excluded by design, and naming the design does not turn the gap into a feature.