phaf is running and reachable over HTTPS. Before you build flows, take fifteen minutes to set the security options and alerts. All of them are in Settings and need an administrator.
Sign-in security
Settings › Security, section Sign-in:
| Setting | Recommended |
|---|---|
| Two-factor authentication | Required for everyone. Users then set up the code with Microsoft Authenticator, Google Authenticator or any TOTP app on their next sign-in. |
| Minimum password length | 12 or more. The default is 10. |
| Character rules | At least one lower case, one upper case and one number (the default). |
| Do not reuse the last | 5 passwords. |
| Password expiry | Follow your policy. When turned on, the minimum is 30 days. |
| Disable inactive accounts | After 90 days. |
After 5 failed sign-ins an account is locked for 15 minutes, and sessions end after 30 minutes. These values are fixed.
Set up your own two-factor code first, in My account, before making it required.
Network access
Settings › Security, section Network access:
- Trusted IPs — the networks your users and integrations work from, for example
10.0.8.0/24. Accepted formats: single address,10.0.8.*, ranges10.0.8.1-50, CIDR and IPv6. - The API is always restricted by these lists; restricting the web console is optional — turn it on.
- phaf refuses rules that would lock out the IP address you are saving from. If you still lose access, see Troubleshooting.
Users and roles
Settings › Users. Give each person their own account with the smallest role they need:
| Role | Can |
|---|---|
| Administrator | Everything, including users, security, certificates and the database. Keep it to two people. |
| Standard | Build, change and run flows; everything except administration. |
| Support | View flows, transactions and logs. No changes. |
| User | View only, like Support. |
For integrations that call the phaf API, create a service user: it can only use an API token, which you create with an expiry date. Temporary accounts (for a consultant, for example) can be set to expire on a given day.
Email alerts
Settings › Alerts:
- Enter the mail server, port and encryption (Automatic, SSL/TLS or STARTTLS), the sender and the recipients. phaf requires TLS 1.2 or later.
- Click Send test email. phaf shows the SMTP conversation, without passwords, if it fails.
- Turn on the error alert, the certificate expiry warning and the daily or weekly status report.
- Set the disk thresholds in system health: above the first one, scheduled receiving pauses; above the second, all processing pauses until space is freed.
Send the audit log to your SIEM (optional)
In Settings › Alerts, section Syslog, enter your syslog server (UDP or TCP) and choose CEF or RFC 5424. Send the audit log at least. Click Send test message to check.
Protect the encryption key
C:\phaf\data\phaf.master_key encrypts every password, key password and two-factor secret stored in phaf.
- Copy it now to a safe place outside the server — for example a password vault or an encrypted offline medium — and label it with the server name.
- Check that only SYSTEM, Administrators and the service account can open
C:\phaf\data(see folder permissions). - Encrypt the data drive with BitLocker or your disk encryption: messages are stored there as files.
Installation checklist
- Installer checked with its SHA-256; phaf in
C:\phaf\app, data inC:\phaf\data - Database chosen; SQL Server connection encrypted, password stored as
ENC:v1: - The phaf service runs under the chosen account and comes back after a reboot
- Console published only over HTTPS; port 8181 closed to the network
- Two administrators; two-factor authentication required
- Password policy and trusted IPs set; proxy header set to
X-Forwarded-For - Email alerts tested; error and certificate alerts on
phaf.master_keycopied to a safe place; data drive encrypted- First backup taken and a restore tested (Backup and restore)