Skip to content
MSP Backups by CVN Technologies

Security

This page covers sign-in, access control and the audit log. For how backup data is protected, see Encryption and key recovery and Immutability and ransomware.

Multi-factor authentication

Every account can turn on MFA with an authenticator app (TOTP). Your brand name is the issuer shown in the app.

  1. Open your account settings (My Account in the global admin portal, Settings in the tenant and user portals).
  2. Turn on MFA, scan the QR code and enter a code to confirm.

To prompt for MFA, turn on Enforce MFA in Settings > Security & access. Anyone who has not set it up then sees a banner on every page asking them to. Sign-in is not blocked for accounts without MFA. Tenant Owners and Admins can reset a user's MFA if they lose their phone.

Single sign-on

MSP Backups supports OpenID Connect single sign-on for the whole platform.

  1. Register an application with your identity provider (for example Microsoft Entra ID, Google or Okta). Use the redirect URI shown on the settings card, which ends in /api/v1/auth/sso/callback.
  2. In the global admin portal, open Settings > Security & access and fill in the issuer URL, client ID and client secret.
  3. Turn SSO on. The sign-in page then shows an SSO button.

SSO signs people in to accounts that already exist, matched by email address. The identity provider must confirm the email address as verified, and the account must be active. SSO does not create accounts.

Sessions

  • Settings > Security & access sets the session timeout (30 minutes by default, 5 minutes to 24 hours).
  • Each user can see their active sessions in their account settings and end any of them. Ending a session takes effect straight away, not at the next timeout.
  • Signing out ends the session on the server.

IP allow-lists

A tenant Owner or Admin can limit where the tenant's users sign in from:

  1. In the tenant admin portal, open Settings > Security & access.
  2. Enter one IP address or CIDR range per line, for example 203.0.113.0/24.
  3. Save.

Signed-in requests from the tenant's users from any other address are refused. An empty list means no restriction. Agents are not affected: they authenticate with device tokens, not user sign-ins. Global admins are not affected either.

Rate limits

Every client IP is rate limited across the API. Sign-in, MFA checks, password-reset requests, SSO starts and agent enrolment have a tighter limit to slow down password guessing.

The audit log

The server records every change made through the API, which covers the portals, API keys and agents. Each event holds:

  • who made it (a user, an API key or a device),
  • the tenant,
  • the action and its result,
  • the source IP,
  • the time, and
  • a category: security, tenant, storage, admin, client or API.

Reads are not recorded. Events are kept per tenant, and row-level security keeps each tenant's events apart. The global admin portal's Audit Logs page shows platform-level events, with search and filters. Agent security alerts (a tampered canary) are recorded too.

Audit events are kept indefinitely unless you set a retention period for them on the server, in which case older events are deleted daily.

API keys and device tokens

  • API keys and device tokens are stored only as hashes.
  • An API key can be limited to read, write or both, and to one tenant or all tenants. See API and webhooks.
  • Agent self-updates (from version 1.0) are checked against our Ed25519 release signature before they are installed. Your server delivers the build but does not sign it.

Data protection requests

For a client's data request, Export on the tenant downloads its data as JSON, and Delete erases the tenant's records. See Tenants.

Edit or report a problem