Who can do what
Four roles: the owner; admins, who manage accounts, reveal credentials, and make share links; users, who add and edit anything but cannot delete a client or a property or reveal a credential; and client portal accounts. Any account can be limited to one client, and then sees that client alone — search, tables, and dashboards included.
Credentials, sealed
Device logins, property access codes, and a client’s vault entries — ISP, registrar, DNS, Microsoft 365, camera logins, with an optional one-time-code seed — are stored only as AES-256-GCM ciphertext. Plaintext leaves the server only through an explicit reveal, which is audited; no list, report, export, search index, or log ever carries a credential.
A record of everything sensitive
Every sign-in, failure, lockout, session revocation, password change, account change, export, and reveal is written to an audit log the app never edits. Managers filter it and export it as CSV, and an exposure report lists every credential one account has revealed, for the day someone leaves. Read how Cablefolio protects your data.
Questions and answers
How does Cablefolio store passwords and device credentials?
Account passwords are stored only as salted PBKDF2 hashes. Device credentials, access codes, and vault entries are sealed with AES-256-GCM and revealed only by an explicit, audited action by an owner or admin.
Does Cablefolio support multi-factor authentication?
Yes. Any account can add an authenticator app (TOTP) as a second factor, with one-time recovery codes. On the Business plan, sign-ins through Google or Microsoft can be trusted to have done their own MFA.
Can I limit a technician to one customer?
Yes. Any account can be limited to one client; it then sees that client only, including in search, tables, dashboards, and exports.