At Element, the security of your company data and candidate information is our top priority. We offer a flexible approach to securing user access. The system includes standard security measures that are always active, as well as a set of 4 additional options that you can configure according to your organization's internal security policies.
1. Configurable Options (Client Choice)
As a Client, you can choose to activate any of the following four security mechanisms:
Multi-Factor Authentication (MFA): Requires users to enter a one-time verification code sent to their email address during every login attempt.
Account Lockout (Brute Force Protection): The system will automatically block login attempts for 15 minutes after detecting 10 failed attempts.
Password Rotation: Forces users to change their password every 90 days.
Strong Password Policy: Enforces strict requirements regarding password complexity.
Strong Password Policy Details
When this option is enabled, user passwords must meet the following criteria:
Length: Must have a minimum of 10 characters.
Complexity: Must include characters from 3 out of the 4 following categories:
Uppercase letters (A-Z)
Lowercase letters (a-z)
Numbers (0-9)
Non-alphanumeric characters (e.g., !@$%*_-+:<>.?.)
Restricted Characters: Avoid using special characters that are not supported on all platforms:
/ \ ' " ^ # spaceand backticks.Repetition: Can have a maximum of 2 repeating characters.
Format: Can be longer (>16 characters) or use passphrases.
Uniqueness: Can NOT contain the username.
History: Can NOT be the same as the previous 24 passwords.
2. System Security (Always On)
Regardless of the configurable options selected, every Element client is protected by a built-in "Throttling" mechanism designed to slow down potential attacks.
How does it work? When a login attempt fails (e.g., due to an incorrect password), the system forces a tiny delay before the next attempt can be processed.
With just a few errors, the delay is a fraction of a second and barely noticeable to a human.
If the number of failed attempts increases (e.g., 8-10 tries), the login time is extended noticeably.
This technique effectively protects the system against bots attempting to guess passwords using "brute force" methods, making such attacks time-consuming and ineffective.