Import initial de Vivier depuis l'hebergement OVH

aide/securite.en.md

@@ -0,0 +1,161 @@
+# Why Vivier protects its access
+
+Vivier holds the CVs, contact details and exchanges of hundreds of candidates. This is personal data. IT Club is accountable for it to the candidates and under the law (GDPR).
+
+A password alone is no longer enough: it can be guessed, stolen through a fake email, or leaked by another website. Vivier adds several protections. Each one blocks a specific attack.
+
+| Protection | What it prevents |
+|---|---|
+| Access by invitation | A stranger creating an account |
+| Two-step verification | A stolen password being enough to get in |
+| Password checks | Using a password already published after a breach |
+| Blocking failed attempts | A program trying thousands of passwords |
+| Limited sessions | A forgotten computer staying signed in for days |
+| Sign-in log | An intrusion going unnoticed |
+| Account manager rights | A single compromised account exporting the whole pool |
+
+This page applies to every account. You can also read it without signing in, from the sign-in page.
+
+# Getting an account: the invitation
+
+Vivier has no open sign-up.
+
+1. The Vivier account manager creates an invitation link for you.
+2. They send it to you, by email or internal chat.
+3. You open the link and choose your username and password.
+4. You set up two-step verification. Your account is ready.
+
+The link works once and expires after 48 hours. Link expired: ask for a new one.
+
+The account manager can also create your account with a temporary password. You then change it at first sign-in. After that, nobody but you knows your password.
+
+# Two-step verification
+
+Each time you sign in, Vivier asks for two proofs:
+
+1. your password, something you know
+2. a 6-digit code shown on your phone, something you have
+
+A thief who knows your password stays out without your phone.
+
+## Setting it up
+
+At first sign-in, Vivier guides you through three steps.
+
+1. Install an authenticator app: Google Authenticator, Microsoft Authenticator, or the password manager you already use (Bitwarden, 1Password, Apple Passwords).
+2. In the app, add an account and scan the QR code Vivier shows. Without a camera, type the key written under the QR code.
+3. Enter the 6-digit code the app shows.
+
+The code changes every 30 seconds. The app works without a network.
+
+## Backup codes
+
+Vivier then gives you ten backup codes, like `abcd-efgh`. They replace the phone code if you lose or forget your phone.
+
+- Each code works once.
+- They are shown only once. Copy them into your password manager, or print them and store the sheet.
+- Running low? **My account**, **Generate new backup codes**. The old ones stop working.
+
+## Changing phones
+
+**My account**, **Set up another app**. Scan the new QR code with the new phone. The old one stops working, your other sessions close and you get ten new backup codes.
+
+## Lost phone
+
+1. Sign in with a backup code, in the code field.
+2. Set up another app right away from **My account**.
+
+No backup codes left: the account manager resets your two-step verification, after checking it is really you. You set it up again at your next sign-in.
+
+## The code is rejected
+
+- Check that your phone sets its time automatically. A gap of more than a minute breaks the code.
+- Enter the code shown now, not the previous one.
+- A code already used does not work twice: wait for the next one.
+
+# Your password
+
+- At least 12 characters. A phrase of several words is easier to remember than a jumble of symbols: `four cats on the blue roof`.
+- Vivier rejects passwords found in known data breaches. To check, it sends the Pwned Passwords service the first 5 characters of the password's fingerprint, never the password itself.
+- Use a password for Vivier only. A reused password falls with the weakest website.
+- Vivier only keeps a fingerprint of the password (Argon2id). Nobody, not even the account manager, can read it.
+
+To change it: **My account**, **Change password**. Your other sessions close.
+
+Forgot your password: the account manager gives you a temporary one, which you change at sign-in.
+
+# Blocking
+
+Vivier counts failed attempts.
+
+- 5 failures on a username, from the same address: blocked for 15 minutes. Then 30 minutes at the 10th failure, and 60 minutes at the 15th.
+- 20 failures in an hour from the same address, any username: the address is blocked.
+- A wrong two-step code counts as a failure.
+- Wrong passwords typed to confirm a sensitive action count too.
+
+The block targets the address the attempts come from. A stranger therefore cannot block your account from their own place.
+
+You are blocked: wait for the time shown, or ask the account manager to lift the block.
+
+# Sessions
+
+- A session closes after 2 hours of inactivity.
+- It always closes 12 hours after sign-in.
+- Changing your password closes your other sessions.
+- **My account**, **Sign out my other sessions** closes everything except the current session. Useful if you stayed signed in on another computer or lost a phone.
+- A disabled account loses all its sessions at once.
+
+Vivier only works over HTTPS: an `http://` address is redirected, and the browser remembers for a year that it must use HTTPS.
+
+# Who sees what
+
+Every account reads and edits all profiles. Some actions affect the whole pool at once: they are for the account manager only.
+
+| Action | Every account | Account manager |
+|---|---|---|
+| Board, profiles, requests, follow-up, dashboard | Yes | Yes |
+| Import, edit, comment on, archive a profile | Yes | Yes |
+| IT Club and Europass CVs, export of one candidate's data | Yes | Yes |
+| CSV export of the profile list | No | Yes |
+| Activity log, retention, trash | No | Yes |
+| Delete a profile | No | Yes |
+| Accounts, invitations, sign-in log | No | Yes |
+| Backup and file archive | No | Yes, with their password |
+
+The account manager types their password again to grant account management to another account, change someone else's password, reset a two-step verification or download the file archive. A session left open is therefore not enough for these actions.
+
+# The sign-in log
+
+Vivier records every sign-in attempt: date, account, IP address, browser, result. The log is kept for 12 months.
+
+- You see your latest sign-ins in **My account**. A sign-in you don't recognise: change your password and tell the account manager.
+- The account manager sees all sign-ins, **Manage** menu, **Sign-ins**.
+- An account manager signing in from a never-seen network triggers an alert email to IT Club.
+
+# The data
+
+- CVs, reports and photos are stored outside the public part of the site, under a random name. They only open after sign-in.
+- Two-step verification keys are encrypted. The encryption key is kept outside the database.
+- No Vivier page appears in a search engine.
+- Every action on a profile is recorded with its author.
+- With automatic analysis, the CV is sent to Anthropic, the maker of Claude, for analysis and translation. No other external service receives candidate data.
+
+# Good habits
+
+- Never share your password or a code, not even with the account manager. They never need it.
+- Be wary of an email asking you to sign in. Type Vivier's address yourself.
+- Lock your screen when you leave your desk.
+- On a shared computer, use **Sign out** when you leave.
+- Download a CV only when you need it, and delete the copy afterwards.
+- Send an anonymised CV when the name is not needed.
+
+# Reporting a problem
+
+Tell the Vivier account manager right away if:
+
+- you see a sign-in you don't recognise
+- you lost your phone or a computer where Vivier was open
+- you typed your password on a suspicious page
+- you receive a code or an invitation link you did not ask for
+
+The account manager can close your sessions, change your password, reset your two-step verification and check the sign-in log.