Skip to content

Authentication & Password Security

This page covers how Agend Product Suite protects member and staff logins. For Agend Pro's WordPress-based password security, see Agend Pro — Password Security.

Authentication

  • Supabase Auth: sign-in via email/password, OAuth/social login, or magic links, depending on how a client configures their product.
  • Multi-Factor Authentication (MFA): time-based one-time passcode (TOTP) MFA is available, with enforcement configurable per account.
  • Enterprise Single Sign-On (SSO): enterprise customers can configure SAML or OIDC SSO per account, with signature verification, audience validation, and replay protection.
  • Shared login across products: signing in once gives access to the Agend Product Suite products a customer has enabled, via secure shared session cookies on agend.com.au subdomains.

Access Control

  • Role-Based Access Control (RBAC): permissions are enforced by role, with a documented process for primary account-owner overrides.
  • Row-level tenant isolation: access control is enforced at the database level via row-level security (RLS), not solely in application code — see Platform Security for detail.

Password Handling

In progress

We have not published a specific password-hashing algorithm for Agend Product Suite on this page. Passwords are managed by Supabase Auth, our authentication provider; we will confirm and publish the specific hashing mechanism here once verified against our current implementation.

Login Protection

  • Rate limiting and abuse-prevention controls apply at the API gateway to slow automated login attempts.
  • CAPTCHA (Cloudflare Turnstile) is applied on public-facing authentication forms.

Questions about authentication can be directed to security@agend.com.au.