Administrator access and account recovery

Public product documentation · v56.0.0 · Cuvena by Arynox

ADMIN ROLES Open Access & security > Admin roles as a platform owner. Create a role, select View for each permitted area, select individual actions, and assign members. Save to apply immediately. Enabled roles combine their permissions. Disabled roles contribute no permissions. A custom-assigned account does not retain implicit administrator or support access from its built-in role.

Owners cannot be restricted through custom roles. Only owners administer role definitions, memberships and built-in staff roles. Deleting a role requires removing or reassigning its members first. Removing a member's final custom role leaves personal profile, help and notifications; Restore built-in access is an explicit owner action.

SUPPORT Standard support requires the configured customer approval. Separate permissions govern requesting access, starting approved read-only access, approved administrator access, ending sessions and privileged access without individual approval. Platform owners retain privileged support without an extra authenticator requirement. Other support staff retain their existing authenticator requirement. Session and action audit records retain the real staff identity and customer approver when applicable in the main customer and platform logs.

AUTHENTICATOR In App or Admin, open My account > Authenticator protection. Sign in again if your current sign-in is older than five minutes. Scan the QR code or enter the manual key in an authenticator app, then submit a generated six-digit code. Cuvena enables protection only after successful verification.

Save the ten recovery codes immediately. The download is private and available once from the setup session for ten minutes. Each code can replace the authenticator code once. Cuvena stores hashes, not reusable plaintext recovery codes, in its database. Plaintext codes are temporarily available in your authenticated server session for display/download. Keep your downloaded file private.

Generate new recovery codes after a recent sign-in with an authenticator or unused recovery code. All previous codes become invalid. Disabling the authenticator removes recovery codes. If you lose both the authenticator and all recovery codes, follow verified operator-assisted recovery.

AUDIT AND ASSURANCE Role changes, authenticator activation, recovery use/regeneration and deactivation are audited without recording keys or recovery codes. These controls support audit preparation; they are not proof of independent certification. Hosting, organisational policies, operational evidence and external assessment remain separate responsibilities.

Security & Trust · Arynox