Password policies

Authentication is the church’s first line of defense. Ministrium applies password policies and session controls. Multi-factor authentication (MFA / TOTP) is not available in the application at this time.

Multi-factor authentication (MFA)

Coming soon. When it becomes available, it will be documented here. No date is committed.

Password policy

Every password in Ministrium must meet:

• Minimum 12 characters.
• At least one uppercase letter, one lowercase, one number, and one symbol.
• Not on the list of compromised passwords (we validate against the public Have I Been Pwned dataset when the password is created or changed).
• Not reusing the user’s last 5 passwords.

We do not require periodic forced rotation. Modern guidelines (NIST SP 800-63B) show that mandatory rotation pushes users toward predictable passwords. Instead:

• We force immediate change if we detect a password in a public breach.
• We force change if suspicious activity is detected on the account.

Session policies

• Short-lived access tokens (15 minutes), automatically renewed with refresh tokens.
• Revocable refresh tokens: signing out invalidates them immediately.
• Automatic session timeout from inactivity after 8 hours on kiosks, 24 hours on desktop.
• Detection of suspicious concurrent sessions (geographic IP or country change); in that case we force re-authentication.
• Password change revokes all active sessions of the user.

Lockout from failed attempts

• After 5 consecutive failed attempts, the account is locked for 15 minutes.
• After 15 failed attempts in one hour from different IPs, an extended 24-hour lockout is applied and the admin is notified.
• The admin can manually unlock from the church’s user administration.

Suspicious activity detection

Ministrium automatically monitors:

• Logins from countries or regions new to the user.
• Multiple logins in very short time from different IPs.
• Unusual data access patterns for the role.

When suspicious activity is detected:

• The user is notified by email.
• The church admin is notified.
• Re-authentication is forced.

Next steps

• Encryption — how passwords and tokens are protected.
• Audit and logs — what is logged from each login.
• Roles and permissions — what each role can do after authenticating.