Vivier/aide/securite.en.md

Why Vivier protects its access

Vivier holds the CVs, contact details and exchanges of hundreds of candidates. This is personal data. IT Club is accountable for it to the candidates and under the law (GDPR).

A password alone is no longer enough: it can be guessed, stolen through a fake email, or leaked by another website. Vivier adds several protections. Each one blocks a specific attack.

Protection	What it prevents
Access by invitation	A stranger creating an account
Two-step verification	A stolen password being enough to get in
Password checks	Using a password already published after a breach
Blocking failed attempts	A program trying thousands of passwords
Limited sessions	A forgotten computer staying signed in for days
Sign-in log	An intrusion going unnoticed
Account manager rights	A single compromised account exporting the whole pool

This page applies to every account. You can also read it without signing in, from the sign-in page.

Getting an account: the invitation

Vivier has no open sign-up.

1. The Vivier account manager creates an invitation link for you.
2. They send it to you, by email or internal chat.
3. You open the link and choose your username and password.
4. You set up two-step verification. Your account is ready.

The link works once and expires after 48 hours. Link expired: ask for a new one.

The account manager can also create your account with a temporary password. You then change it at first sign-in. After that, nobody but you knows your password.

Two-step verification

Each time you sign in, Vivier asks for two proofs:

1. your password, something you know
2. a 6-digit code shown on your phone, something you have

A thief who knows your password stays out without your phone.

Setting it up

At first sign-in, Vivier guides you through three steps.

1. Install an authenticator app: Google Authenticator, Microsoft Authenticator, or the password manager you already use (Bitwarden, 1Password, Apple Passwords).
2. In the app, add an account and scan the QR code Vivier shows. Without a camera, type the key written under the QR code.
3. Enter the 6-digit code the app shows.

The code changes every 30 seconds. The app works without a network.

Backup codes

Vivier then gives you ten backup codes, like abcd-efgh. They replace the phone code if you lose or forget your phone.

• Each code works once.
• They are shown only once. Copy them into your password manager, or print them and store the sheet.
• Running low? My account, Generate new backup codes. The old ones stop working.

Changing phones

My account, Set up another app. Scan the new QR code with the new phone. The old one stops working, your other sessions close and you get ten new backup codes.

Lost phone

1. Sign in with a backup code, in the code field.
2. Set up another app right away from My account.

No backup codes left: the account manager resets your two-step verification, after checking it is really you. You set it up again at your next sign-in.

The code is rejected

• Check that your phone sets its time automatically. A gap of more than a minute breaks the code.
• Enter the code shown now, not the previous one.
• A code already used does not work twice: wait for the next one.

Your password

• At least 12 characters. A phrase of several words is easier to remember than a jumble of symbols: four cats on the blue roof.
• Vivier rejects passwords found in known data breaches. To check, it sends the Pwned Passwords service the first 5 characters of the password's fingerprint, never the password itself.
• Use a password for Vivier only. A reused password falls with the weakest website.
• Vivier only keeps a fingerprint of the password (Argon2id). Nobody, not even the account manager, can read it.

To change it: My account, Change password. Your other sessions close.

Forgot your password: the account manager gives you a temporary one, which you change at sign-in.

Blocking

Vivier counts failed attempts.

• 5 failures on a username, from the same address: blocked for 15 minutes. Then 30 minutes at the 10th failure, and 60 minutes at the 15th.
• 20 failures in an hour from the same address, any username: the address is blocked.
• A wrong two-step code counts as a failure.
• Wrong passwords typed to confirm a sensitive action count too.

The block targets the address the attempts come from. A stranger therefore cannot block your account from their own place.

You are blocked: wait for the time shown, or ask the account manager to lift the block.

Sessions

• A session closes after 2 hours of inactivity.
• It always closes 12 hours after sign-in.
• Changing your password closes your other sessions.
• My account, Sign out my other sessions closes everything except the current session. Useful if you stayed signed in on another computer or lost a phone.
• A disabled account loses all its sessions at once.

Vivier only works over HTTPS: an http:// address is redirected, and the browser remembers for a year that it must use HTTPS.

Who sees what

Every account reads and edits all profiles. Some actions affect the whole pool at once: they are for the account manager only.

Action	Every account	Account manager
Board, profiles, requests, follow-up, dashboard	Yes	Yes
Import, edit, comment on, archive a profile	Yes	Yes
IT Club and Europass CVs, export of one candidate's data	Yes	Yes
CSV export of the profile list	No	Yes
Activity log, retention, trash	No	Yes
Delete a profile	No	Yes
Accounts, invitations, sign-in log	No	Yes
Backup and file archive	No	Yes, with their password

The account manager types their password again to grant account management to another account, change someone else's password, reset a two-step verification or download the file archive. A session left open is therefore not enough for these actions.

The sign-in log

Vivier records every sign-in attempt: date, account, IP address, browser, result. The log is kept for 12 months.

• You see your latest sign-ins in My account. A sign-in you don't recognise: change your password and tell the account manager.
• The account manager sees all sign-ins, Manage menu, Sign-ins.
• An account manager signing in from a never-seen network triggers an alert email to IT Club.

The data

• CVs, reports and photos are stored outside the public part of the site, under a random name. They only open after sign-in.
• Two-step verification keys are encrypted. The encryption key is kept outside the database.
• No Vivier page appears in a search engine.
• Every action on a profile is recorded with its author.
• With automatic analysis, the CV is sent to Anthropic, the maker of Claude, for analysis and translation. No other external service receives candidate data.

Good habits

• Never share your password or a code, not even with the account manager. They never need it.
• Be wary of an email asking you to sign in. Type Vivier's address yourself.
• Lock your screen when you leave your desk.
• On a shared computer, use Sign out when you leave.
• Download a CV only when you need it, and delete the copy afterwards.
• Send an anonymised CV when the name is not needed.

Reporting a problem

Tell the Vivier account manager right away if:

• you see a sign-in you don't recognise
• you lost your phone or a computer where Vivier was open
• you typed your password on a suspicious page
• you receive a code or an invitation link you did not ask for

The account manager can close your sessions, change your password, reset your two-step verification and check the sign-in log.