GoRefer Trust Center
Access Control
Updated September 2026
About this page. The procedures and recovery times described here are our policies and targets. They are not an independent audit, a contractual SLA or proof that a scheduled review has taken place. For current details, assessment reports and records, make a request through the Trust Portal.
GoRefer restricts access by firm, role, client assignment and permission. Your firm's everyday work and GoRefer's own privileged support access follow different access rules.
Role-Based Access Control (RBAC)
Updated September 2026
Role and permission checks run on GoRefer's servers, not just in your browser. The table summarizes the standard firm roles; custom permissions and record-ownership rules can change what each person can do.
| Role | What They Can Do | Restrictions |
|---|---|---|
| Admin | Full firm access | Manage users, commission settings, billing, and all firm data |
| Preparer | Own clients & referrals | Assigned client and referral workflows, subject to firm permissions |
| Client | Client portal only | Submit referrals, check reward status, update profile |
| Agent | Recruiting pipeline | Recruiting and enrollment permissions depend on assigned role |
Firm-scoped access
Each firm's records live in their own database, and firm requests only reach that firm's data. Authorized GoRefer support and administrative-assistance sessions are privileged exceptions with their own controls and audit records. Separate databases do not mean separate, dedicated hardware.
Multi-Factor Authentication (MFA)
Updated September 2026
Authenticator App Support
Time-based one-time passwords (TOTP) — industry-standard 2FA
Works with Google Authenticator, Authy, 1Password, and Microsoft Authenticator
8 one-time backup codes generated on enrollment
Authenticator enrollment through a QR-code setup flow
The setup secret is shown only during enrollment; keep it private, as it is not part of your ordinary profile
Privileged Access MFA
GoRefer operations staff use a separate, isolated authentication process
Privileged product sign-ins include two-factor checks; our broader staff-access policy is available on request
Session expiry follows the sign-in method and its token lifetimes
Supported administrative workflows record security audit events
Session Management
Updated September 2026
Session Security
Short-lived session tokens
Sessions use short-expiry tokens to minimize exposure if a token is ever intercepted
HttpOnly refresh cookie
The browser refresh cookie is inaccessible to JavaScript; access tokens are used by the application in memory. Extension and administrative-assistance flows have separate storage rules.
Separate token and session lifetimes
Access-token expiry and refresh-session revocation are distinct. The extension has a 24-hour session cap; web sessions use their own lifetimes.
Hashed server-side refresh tokens
The server stores a hash of each refresh token. This does not describe every access token or client-side authentication store.
Session Controls
Authorized platform operators can review session records in Security Hub
Authorized session controls can revoke individual refresh sessions
Account workflows provide logout controls; existing access-token expiry is separate
Administrative-assistance sessions are time-limited and record start/stop events
Sensitive actions are restricted during assisted access sessions
Rate Limiting & Brute Force Protection
Updated September 2026
IP-Based Rate Limiting
Sign-in and account-recovery pages apply their own attempt limits
Repeated failed sign-ins within a time window lead to a lockout
Registration: rate limited to prevent mass account creation
Password reset: rate limited with cooldown periods
AI and export limits vary by feature, role and credits
IP Blocklist
IP blocklist management requires a platform Security Hub permission
Platform-level blocklist for known malicious actors
Automatic IP flagging on repeated failed login attempts
Blocklist entries logged in audit trail with timestamp and actor
Blocking at the network edge and firewall rules: details on request