Security built for rail operations
Rail Intel protects competency, medical and safety records with company-scoped access, two-factor authentication and hosting on Microsoft Azure.
Access control
Every sign-in is tied to a company and a named user. Access is logged, and permissions follow the roles your operation defines.
- Company codes Users sign in with a company code, email and password. Tenants stay isolated — one operator cannot see another’s records.
- Role-based permissions What a person can view or change follows their role and any custom permissions your administrators set.
- Logged access Sign-in and sensitive actions are attributable. The product is built for authorised personnel only — all access is logged.
- Session tokens Successful authentication issues a signed session token. Credentials and tokens remain the responsibility of each user to safeguard.
Two-factor authentication (2FA)
When 2FA is required, a correct password is not enough. Rail Intel challenges for a second factor before a session is issued.
- Authenticator app (TOTP) Users enrol an authenticator such as Microsoft Authenticator or Google Authenticator. A time-based code completes sign-in. Secrets are encrypted at rest.
- Email verification codes Where enabled, a six-digit code is sent to the user’s email. Codes can be resent from the sign-in challenge. SMTP must be configured for this method.
- Trusted devices (14 days) After a successful 2FA challenge, users may trust that browser for 14 days so later password logins can skip the second factor. System administrators never skip. Trust is revoked when the password changes, when an administrator resets the authenticator, when the device is removed, when the 14-day window expires, or when the sign-in location no longer matches (country, or coarse network if country is unknown).
How 2FA is governed
These rules keep second-factor policy under administrator control while giving users a clear path to enrol and recover.
-
Policy is administered centrally
System administrators manage 2FA from Administration → Security: authenticator on or off, email codes on or off, and company or user method overrides. Users cannot turn the requirement off themselves.
-
Enrolment at sign-in
If authenticator 2FA is required and the user has not enrolled yet, they are guided through QR setup on the next sign-in before access is granted.
-
When trusted status ends
A trusted device only skips 2FA while the cookie is valid, the last MFA was within 14 days, and the location still matches. A password change, authenticator reset, revoked device, expired trust, or a change of country / network forces a fresh 2FA challenge.
-
Administrator reset and backup codes
Administrators can reset a user’s authenticator; the user enrols again on the next sign-in if 2FA is still required. Re-enrolment needs the current authenticator or a backup code so a lost phone cannot silently replace a working second factor.
Hosted on Microsoft Azure
The Rail Intel application runs on Azure App Service with Azure Database for PostgreSQL and Azure Blob Storage for documents — so platform security inherits Azure’s enterprise controls.
- Azure App Service The application is deployed to Azure App Service with HTTPS. Microsoft manages the underlying host patching and regional availability.
- Azure Database for PostgreSQL Operational data is stored in Azure PostgreSQL with TLS required for database connections (`sslmode=require`). Backups and storage sit inside Azure’s managed database service.
- Encryption in transit and at rest Client traffic uses HTTPS. Database connections use TLS. Authenticator secrets (and related credentials) are encrypted at rest with AES-256-GCM. Azure encrypts managed disks and storage by default.
- Azure Blob Storage for files Employee documents, OH reports, training files, logos and profile photos are stored in Azure Blob Storage under company-scoped paths — not on the local app disk in production.
- Network and platform protections Azure provides DDoS protection at the platform edge, identity and access management for the subscription, and continuous security updates to the hosting stack.
- Azure compliance portfolio By hosting on Azure, Rail Intel sits on infrastructure that Microsoft maintains under widely recognised certifications (including ISO and SOC programmes). Ask us for the current region and any customer-specific compliance needs.
Questions about security?
We can walk through 2FA policy, Azure regions and how access is controlled for your company before you go live.