Overview
Konfir applies technical and operational controls to protect verification data within the platform. Your organisation also plays an important role in keeping access tight and handling outputs safely.
Disclaimer: This article outlines the key responsibilities customers should follow when using Konfir. For Konfir’s formal security documentation, certifications, and legal terms, refer to: https://www.konfir.com/client/security
Secure your workspace with MFA
Multi-Factor Authentication (MFA) materially reduces the risk of account takeover.
If MFA is enabled for your workspace, users will be prompted to provide a one-time code from an authenticator app when signing in. See: Enable Multi-Factor Authentication (MFA)
Manage access and permissions
Workspace access is one of the biggest drivers of real-world security risk. Keep access simple, intentional, and regularly reviewed.
Best practices include:
Restrict access to users who genuinely need it
Remove access promptly when someone leaves your organisation or changes role
Review access periodically, especially for privileged Admin roles
Avoid shared accounts or shared inboxes as Konsole user identities
Learn more: To understand role types and permissions, see: Roles & permissions, Manage users and admin access
Handle verification outputs with care
Verification results contain personal data. If you export data from Konfir (for example via API endpoints or downloaded reports), you are responsible for securing those outputs within your own systems.
Ensure downstream handling aligns with your internal policies and requirements, including:
Access controls
Secure storage
Retention and deletion rules
Appropriate internal sharing restrictions
Learn more: For retention rules governing data held in Konfir systems, refer to: Data retention and deletion lifecycle
Minimise admin access
Admins have privileged powers, including approving access requests and changing workspace settings.
Limit Admin roles to only those who require elevated access, and review Admin membership regularly.
Report suspicious activity promptly
If you believe your workspace may be at risk - for example unexpected access, unusual exports, or suspected compromise - contact Support as soon as possible. See: Reporting a suspected security issue