User Account Security

Torque applies account controls to authentication, recovery, profile access, and role permissions.

Account access and recovery

Protected account settings require authentication. Profile-scoped settings also require an ownership check. Password reset and multi-factor authentication (MFA) recovery use the identity provider's verified flow. A client route alone cannot change a credential. MFA requires a second verified factor in addition to the account credential.

See Account Security and Device Experience for the account requirements.

Access and authority boundaries

Least privilege gives each role only the access needed for its tasks. Platform roles separate Issuer fund work, Administrator platform administration, and Operator enterprise scope. The identity and application services that own an action also own its detailed authorization checks.

Page access does not grant authority to sign a fund-owned operation. Fund-manager operations defines the separate fund-owner signing boundary.

Practical checks

• Use the verified identity-provider flow for MFA or password recovery.
• Confirm the selected profile and responsible owner before continuing a financial action.