Overview
Billing
Subscription ManagementSecurity Settings
The Security settings page provides controls for authentication policy, multi-factor authentication enforcement, password requirements, and a real-time overview of login activity across your church's SanctuaryOS account.
Getting Here
Navigation: Settings → System → Security
Security Dashboard
The top of the page displays three summary cards with key security metrics:
| Field | Type | Description |
|---|---|---|
| Active Sessions | Count | Number of users currently logged in, shown alongside the total user count. |
| Failed Logins (24h) | Count | Number of failed login attempts in the last 24 hours. Also shows the 7-day count. A high number may indicate a brute-force attempt. |
| MFA Enrollment Rate | Percentage | Percentage of staff users who have enrolled in multi-factor authentication. Shows enrolled count vs. total. |
Multi-Factor Authentication (MFA)
MFA adds a second verification step beyond the password. SanctuaryOS supports enforcing MFA for all staff users.
MFA Enforcement
| Field | Type | Description |
|---|---|---|
| Require MFA for all staff | Toggle | When enabled, all staff users must enroll in MFA before accessing the application. Toggle takes effect immediately. |
| View MFA Status | Link | Opens the Users page filtered to show MFA enrollment status for each user. |
Password Policy
Configure the password requirements that apply to all user accounts. Changes take effect immediately — existing users will be required to meet the new policy on their next password change.
| Field | Type | Description |
|---|---|---|
| Minimum Password Length | Select | Choose from 8, 10, 12, or 16 characters. Default: 12. |
| Require Uppercase Letter | Toggle | Passwords must contain at least one uppercase letter (A-Z). Default: enabled. |
| Require Numbers | Toggle | Passwords must contain at least one numeric digit (0-9). Default: enabled. |
| Require Special Characters | Toggle | Passwords must contain at least one special character (!@#$%^&*, etc.). Default: disabled. |
| Password Expiry | Select | Force password reset after a period: Never, 90 days, 180 days, or 1 year. "Never" is acceptable for MFA-enrolled accounts. |
Rate Limiting
Rate limits are enforced at the API level and cannot be changed through the settings page. They are displayed for transparency:
| Field | Type | Description |
|---|---|---|
| Authenticated Requests | Read-only | 60 requests per minute per authenticated user. |
| Login Attempts | Read-only | 10 requests per minute per IP address. Helps prevent brute-force attacks. |
Saving Changes
Click Save Security Settings at the bottom of the page to apply password policy changes. The MFA enforcement toggle saves immediately when toggled. A confirmation toast appears when settings are saved successfully.