Security

This page describes the security controls Elixion, the platform for Engineering Intelligence™, puts in your hands, and what each one does. For the compliance posture and how to request reports, see the Elixion trust page.

Passwords

When you set or change a password:

• It must be at least 8 characters. Length beyond 12, plus a mix of upper and lower case, digits and symbols, raises its strength score.
• It is checked against a public breach corpus. A password that appears in a known breach is refused. If that service cannot be reached the check is skipped rather than blocking you.
• It cannot repeat any of your last 5 passwords.

There is no password expiry. Elixion does not force a periodic change.

Lockout

After 5 failed sign-in attempts an account is locked for 30 minutes. Sign-in, registration and password-reset requests are also rate limited.

Two-factor authentication

Open Settings > Security to enrol.

• The supported method is a time-based one-time password from an authenticator app.
• Enrolment issues 10 single-use recovery codes. Store them somewhere you can reach without your phone.
• SMS and email codes are not supported.

Administrator and superuser accounts must enrol before they get a session, whatever their organization's policy says.

Requiring it for everyone

An organization owner or administrator can require multi-factor authentication for every member from Settings > Organization. The switch is off until someone turns it on, and turning it on affects every member of the organization.

Single sign-on

Settings > SSO points your organization's members at your own identity provider. The page configures OpenID Connect (OIDC) and lets you decide which email domains the provider may vouch for. SAML 2.0 (sign-in started from Elixion) is also supported and is set up through the admin API or by contacting support.

The page shows an access-denied state to anyone who may not administer the organization, and that decision is made by the server rather than guessed in the browser.

Directory sync

Settings > Directory sync mints a SCIM credential so your identity provider can add and update the organization's members automatically, and record when one leaves. Recording a leaver does not yet remove their access on its own, so also remove them from Settings > Organization. The credential can be revoked at any time.

Sessions

Settings > General lists your active sessions. You can sign out one device, or all other devices at once.

Token lifetimes:

• An access token lasts 60 minutes.
• A refresh token lasts 30 days.
• A stored session record lasts 24 hours.

Elixion does not implement an idle timeout or a cap on concurrent sessions.

API keys

Settings > General > API keys issues tokens for programmatic access.

• A key is created with a name, a description and a set of scopes. Read is the default scope.
• Expiry is chosen at creation: 7, 30, 90 or 365 days, or no expiration. 90 days is preselected.
• The cleartext value is shown once, at creation. Elixion stores only a hash of it.
• The list shows each key's scopes and when it expires, flagging keys already past their expiry.
• A key can be disabled or deleted.

Keys carry your permissions. A key cannot reach a project you cannot.

Rate limits

Requests are rate limited per principal. The platform default is 500 requests per minute for writes. Reads get a higher allowance than writes, and search shares the read budget. The Claude connector has its own budget of 120 requests per minute per grant.

Per key figures are reported by GET /api/v1/api-keys/{id}/rate-limit. The limits applied to a request are the per principal ones above.

When you hit a limit the response says so and names the window to wait.

Audit log

Security-relevant events are recorded in an audit log, with a default retention of 90 days. Events cover authentication, membership and permission changes, and resource changes.

Audit coverage is selective rather than total: the events that are emitted are recorded, and the log is not a complete transcript of every action in the product.

Data handling

• Archiving an issue is reversible and deletes nothing.
• Deleting a user account keeps the row so that audit references survive.
• An organization's data can be exported through the organization export endpoint.

For encryption, sub-processors, penetration testing and compliance reports, read the Elixion trust page, which is the page that is kept current on those subjects. Security questions go to security@elixion.ai.

Good practice for the people you administer

• Require multi-factor authentication once everyone has enrolled, rather than before.
• Give Viewer to people who only need to read. It is a real tier, not a label.
• Review project membership when someone changes team, and remove them from the project as well as the workspace.
• Scope API keys to read unless a key needs to write, and give it an expiry.

Next: Notification Types.