Security & Access Guide

Every Aegis account is protected by time-based one-time passwords. During first-time setup, the wizard displays a QR code. Scan it with any TOTP app, enter the 6-digit code to confirm, and 2FA is active.

Admins can also enable a global 2FA toggle so that no user can opt out. If a Shield policy requires MFA for a specific resource, the captive 2FA portal enforces it at access time, even for users who normally log in with just a password.

• TOTP codes are generated on your device; Aegis never sees the secret after enrollment.
• If you lose your authenticator, contact your admin to reset 2FA — there is no self-service recovery by design.
• Use standard apps like Google Authenticator, Microsoft Authenticator, or Authy.

When your organization allows it, you will see a Remember this device checkbox after a successful 2FA. Checking it skips the second factor for that browser on that device for up to the configured number of days.

This is a convenience feature, not a security relaxation. Changing your password revokes every trusted device immediately. Admins set the maximum trusted-device lifetime in Global Settings.

• Only check the box on devices you personally control.
• Trusted status is tied to the browser; clearing cookies revokes it.
• A password change invalidates all trusted sessions everywhere.

Access control in Aegis is deterministic. Shield policies are JSON statements made of an effect, actions, and resource URNs. They are evaluated for every request, so the same user may have different rights in different folders.

For sensitive resources, an Allow block can include a `requireMfa: true` flag. That flag triggers the captive 2FA portal before the action is permitted. This lets you keep daily workflows light while tightening controls on the most sensitive documents.

• Deny statements override Allow when they match the same action and resource.
• Resource URNs can target folders, individual files, or admin functions.
• Policy changes take effect on the next request; there is no caching delay.

The DocumentProtection overlay is the client-side half of Aegis security. It ensures that even if someone gets pixels on screen, extracting the original content is hard. The view blurs when the window loses focus, PrintScreen is blocked, and dev-tools keys like F12 are intercepted.

The overlay also blocks context menus, copy/cut, drag operations, and common save/print shortcuts. An anti-dev-tools worker runs in the background to detect tampering. These controls align with OWASP's guidance on layered client defenses: no single control is perfect, but together they raise the cost of extraction significantly.

• Blurring on window blur prevents shoulder-surfing and quick captures.
• Blocking PrintScreen and Ctrl+S removes the easiest exfiltration paths.
• Virtual-camera detection adds a guard against screen-capture malware.
• All client protections are backed by server-side rendering, so the original file is never on the endpoint.

Your master password is the key to your account. Choose a long passphrase or use a password manager. Aegis hashes passwords with bcrypt, so even a full database breach would not reveal usable credentials.

If you suspect your account is compromised, change your password immediately. That action revokes all trusted devices and active sessions, forcing a fresh login everywhere.

• Do not reuse your Aegis password on other sites.
• A password change is the fastest way to kill a stale session.
• Admins can force password resets from the Users tab if they detect suspicious activity.

Security in Aegis is a partnership between server policy and client behavior. Keep your TOTP device safe, trust only your own devices, and report anything unusual. To see the full model in action, request a demo.