Skip to main content
Empuls enforces strong, configurable password controls for all local accounts so that even when SSO is not used, user authentication remains resilient against brute-force and credential-stuffing attacks.
Empuls enforces strong, configurable password controls for all local accounts so that even when SSO is not used, user authentication remains resilient against brute-force and credential-stuffing attacks. These controls are consistently applied across admin and end-user interfaces and are backed by formal Password Management and Access Control policies.

​
Password complexity and construction

  • Minimum password length of 8+ characters for standard users; 15+ characters for high-privilege/administrator accounts.
  • Passwords must contain upper- and lower-case letters, numbers, and special characters, and must not include easily guessable personal information.
  • Complexity checks are enforced at the time of password creation and change; weak passwords are rejected.

​
Password ageing, reuse, and history

  • Maximum password age: 45 days – users are prompted and required to change passwords regularly.
  • Minimum password age: 1 day – prevents rapid cycling through passwords to bypass password history.
  • The previous five passwords cannot be reused, enforcing genuine rotation over time.

​
Account lockout and failed attempts

  • After five unsuccessful login attempts, the account is automatically locked; users must contact the IT/administration team to unlock the account after identity verification, protecting against brute-force attacks.
  • Error messages on failure do not reveal whether the username or password was incorrect, reducing information leakage.

​
Session management and timeouts

  • Session time-out is enforced on critical systems: inactive application and admin sessions are automatically terminated after a defined inactivity period, with re-authentication required for continued access.

​
Password storage and protection

  • All passwords and secret authentication information are hashed or encrypted with salting and are only readable by processes with elevated administrator privileges.
  • Passwords are masked on screen during entry and are never transmitted via email or other insecure channels.

​
User awareness and governance

  • The Password Management Policy defines clear user responsibilities for keeping passwords confidential, avoiding reuse, and reporting suspected compromise.
  • Compliance with password rules is subject to periodic audits and disciplinary processes in case of violations.
These controls, combined with MFA and SSO where available (described in the Authentication section), ensure that local Empuls accounts meet your organisation’s requirements for password expiry, complexity, lockout behaviour, and session security. Learn more: Empuls Help Centre

How does Xoxoday Empuls handle password and encryption requirements?

Xoxoday Empuls enforces ISO 27001-aligned password policies and TLS 1.2 encryption for all data in transit and at rest.

Does Empuls support Single Sign-On (SSO) for employee login?

Empuls supports SSO via SAML and OAuth standards, letting employees log in with corporate credentials for secure, seamless access.