Security Settings

Configure two-factor authentication, session timeouts, and access controls for your TotalApp instance.

Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step — a time-based one-time password (TOTP) — on top of the password login. Once enabled, every sign-in requires both the password and the current 6-digit code from an authenticator app.

Option	Description
Enable 2FA	Toggle 2FA on for your account. A QR code is displayed — scan it with an authenticator app (Google Authenticator, Authy, 1Password, etc.) to register the TOTP secret.
Backup codes	Generate one-time backup codes to use if you lose access to your authenticator app. Store them securely offline.
Require 2FA for all users	Admin option — forces 2FA enrollment for every user on the TotalApp instance. Users who have not set up 2FA are prompted on next login.

Backup codes are single-use

Each backup code can only be used once. After use it is invalidated. Generate a new set if you have used or lost your backup codes.

Session Timeout

Automatically sign out idle sessions to reduce the risk of unauthorised access on shared or unattended machines.

Option	Values	Description
Session timeout	15 min / 30 min / 1 hr / 4 hr / Never	The period of inactivity after which TotalApp automatically ends the session and requires re-login.
Warn before timeout	On / Off	Show a countdown warning 2 minutes before the session is terminated, giving the user the option to extend it.

Recommended for shared workstations

Set the session timeout to 30 minutes on shared machines. Personal workstations with full-disk encryption can safely use Never.

Audit Log

The audit log records sign-ins, settings changes, and data mutations (record create / update / delete). Entries include the timestamp, user ID, action type, and affected resource.

Option	Description
Enable audit log	Start recording security-relevant events to the server log file.
Retention period	How many days to keep audit log entries before they are pruned. Default: 90 days.
Export log	Download the current audit log as a JSON file for external review or compliance purposes.

FAQ

What authenticator apps work with TotalApp 2FA?

Any TOTP-compatible app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and others. The QR code encodes a standard TOTP secret compatible with RFC 6238.

Can I disable 2FA without access to my authenticator app?

Use one of your backup codes to sign in, then navigate to Security Settings and disable 2FA. If you have no backup codes and no authenticator access, an administrator can reset your 2FA enrollment from the server.

Does the audit log capture AI prompts and responses?

No. The audit log records access and mutation events — not content. AI conversation content stays in the terminal session only and is never written to the audit log.