# Security information

Phocas keeps your business data safe and secure, while also being easily accessible to the people who need it.

Watch this brief Phocas demo video and read the additional information below.

{% embed url="<https://phocassoftware.wistia.com/medias/c7usqr9meb>" %}

Security-related questions people often ask are:

* Is my data safe?
* How does Phocas encrypt passwords?
* How is my data backed up?
* Does Phocas actively monitor security risks?
* Is Phocas SOC 2 and GDPR compliant?

Answers to these questions and more information can be found on the **Security and Technology** and **Terms and Conditions** pages on our website:

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td><strong>Security and Technology</strong></td><td>Learn about our infrastructure (data security, encryption, and more), application, compliance, and operational practices         </td><td></td><td><a href="https://content.gitbook.com/content/qRvX8Eg8GftkyP0R8RVU/blobs/WRYW4AKpFxgm0PABfBjq/security1.png">security1.png</a></td><td><a href="https://www.phocassoftware.com/platform/technology">https://www.phocassoftware.com/platform/technology</a></td></tr><tr><td><strong>Terms and Conditions</strong>   </td><td><strong>General Data Protection Regulation (GDPR)</strong></td><td>Learn about our GDPR compliance and what services we offer to help you meet your compliance obligations       </td><td></td><td><a href="https://content.gitbook.com/content/qRvX8Eg8GftkyP0R8RVU/blobs/EIU33ZySXp9LDZhQr7YK/gdpr.png">gdpr.png</a></td><td><a href="https://www.phocassoftware.com/terms/gdpr-statement">https://www.phocassoftware.com/terms/gdpr-statement</a></td></tr><tr><td></td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

## Session timeout overview

When using Phocas, your session stays active for a while, so you don’t need to sign in repeatedly. However, to help protect your data and ensure system security, user sessions are designed to automatically expire (time out) after periods of inactivity or in specific situations. When this happens, you need to sign in again to continue working.&#x20;

Your session can expire for several reasons, including but not limited to the following situations. Please note that this list is subject to change.

* When your administrator:
  * Forces you to sign out
  * Locks or deletes your user account
  * Changes your username or password

* After a set time period:
  * Each session will automatically expire after 12 hours
  * If you [impersonate another user](https://app.gitbook.com/s/vQCmtGTR7MsjcI62Vdki/users/impersonate-a-user), the impersonation session will timeout after 1 hour

## Multi-factor authentication

Phocas doesn’t natively support multi-factor authentication (MFA), but if you’re looking for that level of security, you can [set up single-sign on (SSO)](https://app.gitbook.com/s/vQCmtGTR7MsjcI62Vdki/configuration/set-up-sso) for your Phocas site.&#x20;