Authentication

RI Platform protects user access through authenticated sessions, server-side account checks, password handling, password reset flows, and two-factor authentication support.

Authentication is enforced by backend services. This means access to protected platform resources does not depend only on whether a user can see a page, button, or menu item in the interface.

Authentication model

RI Platform uses authenticated sessions to identify the current user and protect account and workspace resources.

Session handling is designed to support:

• Authenticated access to protected areas of the platform.
• Backend checks before returning protected user or workspace data.
• Session refresh flows.
• Logout handling.
• Protection against common web session risks.
• Controlled access to workspace-scoped resources.

These controls help ensure that users are authenticated before accessing RI Platform resources such as workspaces, datasets, experiments, datasources, deployments, API keys, and results.

Backend-enforced access

Authentication decisions are enforced by backend services.

The user interface helps guide users through login, logout, and protected navigation, but backend services remain the source of truth for whether a request is authenticated and allowed.

This helps protect platform resources from:

• Direct endpoint access.
• Modified URLs.
• Bypassed interface flows.
• Unauthorised automated requests.
• Attempts to access resources without a valid authenticated session.

For more information about how authenticated users are authorised within workspaces, see RBAC & Permissions.

Password handling

Passwords are handled server-side.

Password-related flows include:

• Password hashing before storage.
• Password validation during login.
• Password reset flows.
• Time-limited reset tokens.
• Rate limiting on sensitive account actions.

These controls help reduce the risk of account compromise and make it harder for attackers to abuse login or password reset flows.

Password reset

RI Platform supports password reset workflows for users who need to recover account access.

Password reset flows are designed to use time-limited reset tokens. This helps reduce the risk of old reset links being reused after they are no longer needed.

Customers should ensure that users keep their email accounts secure, as email may be used for account verification or account recovery.

Two-factor authentication

RI Platform supports two-factor authentication flows.

Two-factor authentication adds an additional verification step during secure authentication, helping protect accounts even if a password is compromised.

Where enabled, two-factor verification is checked by backend services before access is granted.

Customers should enable two-factor authentication when possible.

Secure authentication and workspace access

Authentication confirms who the user is. Workspace permissions determine what that user can access after signing in.

A user may be able to authenticate successfully but still only access the workspaces they have been invited to. Within each workspace, their role determines which actions they can perform.

This separation helps ensure that:

• User identity is handled separately from workspace membership.
• Workspace access can be granted or removed without changing the user’s whole account.
• Administrative actions can require higher permissions than ordinary workspace access.
• Different teams, projects, customers, or environments can be separated using different workspaces.

For more information, see RBAC & Permissions.

Customer responsibilities

Customers play an important role in protecting account access.

Recommended practices include:

• Use strong, unique passwords.
• Enable two-factor authentication when possible.
• Avoid shared user accounts.
• Remove users who no longer require access.
• Review workspace membership regularly.
• Assign administrative permissions only where needed.
• Keep user email accounts secure.
• Ensure account access follows internal joiner, mover, and leaver processes.

How this supports secure administration

Authentication controls help customers administer RI Platform securely by:

• Requiring users to authenticate before accessing protected resources.
• Enforcing secure authentication through backend services.
• Supporting password reset and two-factor authentication flows.
• Separating authentication from workspace-level permissions.
• Allowing access to be managed through workspace membership and roles.

These controls help make user access intentional, reviewable, and aligned with customer administration processes.