Security and data protection
Identity, sessions, permissions, the audit trail and the separation between businesses are built into the platform; personal data work follows each country's law.
Security
- Sign-in runs on Cobista's own accounts: passwords of at least 12 characters, checked against common ones and stored with Argon2id
- Two-step sign-in with an authenticator app and 8 single-use recovery codes; a business can make it compulsory for every member
- Sign in with a passkey using your device's PIN or biometrics, without typing an e-mail
- Single sign-on through SAML 2.0 or OpenID Connect; on domains verified by DNS record, password sign-in can be switched off
- SCIM 2.0 lets Entra ID, Okta or Google add, update and deactivate people; a deactivated person's sessions end
- Sessions end after 8 idle hours by default; a business can set an idle limit of 5–1440 minutes and a maximum of 1–720 hours
- Restrict a business's screens and API keys to up to 100 IP addresses or ranges
- 8 failed sign-in, code or reset attempts within 15 minutes lock that key for 5 minutes
- Every commercial and financial change is logged with who and when; the database refuses edits or deletions of the log
- Custom roles with a permission grid, reach limited to own, managed or all records, and warnings for 5 separation-of-duties conflicts
- Database triggers refuse any record that points to another business's data, on every table
- National ID and social security numbers, birth dates, Harvest keys and calendar links are encrypted with AES-256-GCM, a key per business
Data protection
- Privacy notice versions per audience; consent is given through a one-time link only that person holds
- Data subject requests get their due date worked out, 30 days by default; the last 7 days and overdue ones are flagged
- Breach register with a 72-hour countdown from detection, and reminders at 24 hours left and at the deadline
- Processing inventory with data categories, legal grounds and special categories that follow your country's data protection law
- Track processors and sub-processors, their data processing agreements and the basis for transfers abroad
- Personal data is erased on request or when a retention period you set ends; records the business must keep stay
- Every view, change or erasure of an employee's encrypted fields is logged with who did it
- Owners and admins download all core records as a ZIP of CSV files; each download is logged