# Credential vault and security

> Cablefolio protects the most sensitive part of network documentation — the logins — with an encrypted vault, roles and per-client limits, multi-factor sign-in, and an audit log of every reveal.

- Owner, admin, user, and client roles, and any account limited to one client
- Authenticator-app second factor with one-time recovery codes
- Device and client credentials sealed with AES-256-GCM; every reveal audited
- An audit log with CSV export and a credential exposure report per account

## Who can do what

Four roles: the **owner**; **admins**, who manage accounts, reveal credentials, and make share links; **users**, who add and edit anything but cannot delete a client or a property or reveal a credential; and **client** portal accounts. Any account can be limited to one client, and then sees that client alone — search, tables, and dashboards included.

## Credentials, sealed

Device logins, property access codes, and a client’s vault entries — ISP, registrar, DNS, Microsoft 365, camera logins, with an optional one-time-code seed — are stored only as AES-256-GCM ciphertext. Plaintext leaves the server only through an explicit reveal, which is audited; no list, report, export, search index, or log ever carries a credential.

## A record of everything sensitive

Every sign-in, failure, lockout, session revocation, password change, account change, export, and reveal is written to an audit log the app never edits. Managers filter it and export it as CSV, and an **exposure report** lists every credential one account has revealed, for the day someone leaves. Read [how Cablefolio protects your data](https://cablefolio.com/security/).

## Questions and answers

### How does Cablefolio store passwords and device credentials?

Account passwords are stored only as salted PBKDF2 hashes. Device credentials, access codes, and vault entries are sealed with AES-256-GCM and revealed only by an explicit, audited action by an owner or admin.

### Does Cablefolio support multi-factor authentication?

Yes. Any account can add an authenticator app (TOTP) as a second factor, with one-time recovery codes. On the Business plan, sign-ins through Google or Microsoft can be trusted to have done their own MFA.

### Can I limit a technician to one customer?

Yes. Any account can be limited to one client; it then sees that client only, including in search, tables, dashboards, and exports.

## How-to guides

- [Accounts and security](https://cablefolio.com/help/accounts-and-security/)
- [The client portal](https://cablefolio.com/help/client-portal/)

## Related features

- [Client portal and sharing](https://cablefolio.com/features/client-portal-and-sharing/): A read-only customer portal, expiring share links, one-time secret links, and credential requests.
- [API and webhooks](https://cablefolio.com/features/api-and-webhooks/): Scoped API tokens, an OpenAPI reference, signed webhooks, and imports from common tools.
- [Offline field app](https://cablefolio.com/features/offline-field-app/): Keep a property on the phone, work with no signal, and sync in order with clear conflicts.