Last updated: 17 September 2026
1. Password protection
Floorlayer Connect does not store passwords in readable form. Passwords are processed using a modern one-way password-hashing algorithm. Where the hosting environment supports it, Argon2id is used; otherwise PHP's current secure default password-hashing algorithm is used. Existing password hashes may be upgraded automatically after a successful sign-in when stronger settings become available.
2. Password requirements
Passwords must contain at least 15 characters and may contain up to 128 characters. A secure password generator is available during registration and password reset. Account holders should use a unique passphrase that is not used for another service and should store it in a reputable password manager.
3. Email verification
New accounts must verify their email address before sign-in. Verification links use random, single-use tokens, are stored only as hashes and expire after a limited period. Floorlayer Connect will never ask for an account password by email or telephone.
4. Password resets
Password reset links are single-use, expire after one hour and are sent only to the verified account email address. Public reset-request responses do not reveal whether an email address is registered, and repeated requests are restricted.
5. Sign-in safeguards
Repeated failed sign-in attempts are restricted to reduce automated password attacks. Sign-in responses avoid confirming whether a particular email address is registered. Successful authentication creates a new session identifier, and account cookies are configured to restrict script access and cross-site use.
6. Protecting account and company data
Account pages are delivered over HTTPS. Database operations use parameterised queries, forms use anti-forgery tokens, and access to private configuration is kept outside the public website directory. Access to personal and company information is limited to authorised users and administrators who need it for the service.
7. Monitoring and security records
Security events may be recorded to investigate misuse and maintain the service. Passwords are never written to security logs. Sign-in controls use non-readable hashes of identifiers where practical, and old attempt records are removed periodically.
8. Account-holder responsibilities
Account holders must keep login details confidential, sign out on shared devices and notify Floorlayer Connect promptly if they suspect unauthorised access. Company account owners are responsible for removing access when a team member no longer requires it.
9. Security incidents
Suspected incidents are assessed, contained and documented. Where a personal-data breach creates a legal notification duty, Workforce Connect Ltd will notify the relevant authority and affected individuals within the applicable timescales.
10. Contact
Report a suspected account-security issue to enquiries@floorlayerconnect.co.uk.