Access & authentication
How people get into Demerzel — and what’s recorded when they do — is designed to remove whole classes of risk rather than manage them.
Passwordless by design
There are no passwords, so there is no password database to breach, no reuse across sites, and no phishable shared secret. You sign in one of three ways:
- Email code — a 6-digit code sent to your address. It is single-use, short-lived, rate-limited, and stored only as a keyed hash.
- Passkey — Face ID, Touch ID or your device’s unlock (WebAuthn). The private key never leaves your device; Demerzel stores only the public key, and a passkey is bound to Demerzel’s domain, so a look-alike site cannot use it. Set one up, or remove one, under Settings → Face ID & Touch ID; the email code stays available as a fallback.
- Social sign-in — Google, GitHub, Microsoft, GitLab, Discord or Slack. A social account is only linked to yours when the provider confirms the email is verified, which prevents someone from claiming your account with an unverified address.
Least privilege
Every member has one of three roles:
| Role | Scope |
|---|---|
| Owner | Full control, including billing-level actions, granting ownership and deleting the organization. |
| Admin | Manage members, notifications and data; act on alerts. |
| Read-only | View everything; change nothing. |
Roles are enforced on the server (see Tenant isolation), and an organization is never left without an owner.
Sessions
Sessions are server-side and the session identifier is regenerated on sign-in to defeat fixation. Signing out ends the session immediately.
A complete audit trail
Every meaningful action is recorded in an append-only activity log — sign-ins (with the method used: email code, passkey or social provider), passkeys added, invitations, role changes, member removals, alert-channel changes, the decisions taken on alerts, server renames, notes, silences and public share links enabled or revoked, agents renamed or deleted, the organization’s fleet signing key being created, and every unban sent to your fleet, with its reason. See Activity log & audit for the full list. Each entry captures the member, the request IP and user agent, and a precise timestamp. Owners and admins can review and filter the organization’s entries at any time.