> For the complete documentation index, see [llms.txt](https://docs.phocassoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.phocassoftware.com/other-information/security-information.md).

# Security information

Learn about what we do to keep your data safe and secure.

Phocas keeps your business data safe and secure, while also being easily accessible to the people who need it.

## Data security

Watch this brief Phocas demo video and read the additional information below.

{% embed url="<https://phocassoftware.wistia.com/medias/c7usqr9meb>" %}

Security-related questions people often ask are:

* Is my data safe?
* How does Phocas encrypt passwords?
* How is my data backed up?
* Does Phocas actively monitor security risks?
* Is Phocas SOC 2 and GDPR compliant?

Find answers to these questions and more information on our website:

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td><strong>Security and Technology</strong></td><td>Learn about our infrastructure (data security, encryption, and more), application, compliance, and operational practices</td><td></td><td><a href="https://content.gitbook.com/content/qRvX8Eg8GftkyP0R8RVU/blobs/WRYW4AKpFxgm0PABfBjq/security1.png">security1.png</a></td><td><a href="https://www.phocassoftware.com/platform/technology">https://www.phocassoftware.com/platform/technology</a></td></tr><tr><td><strong>Terms and Conditions</strong></td><td><strong>General Data Protection Regulation (GDPR)</strong></td><td>Learn about our GDPR compliance and what services we offer to help you meet your compliance obligations</td><td></td><td><a href="https://content.gitbook.com/content/qRvX8Eg8GftkyP0R8RVU/blobs/EIU33ZySXp9LDZhQr7YK/gdpr.png">gdpr.png</a></td><td><a href="https://www.phocassoftware.com/terms/gdpr-statement">https://www.phocassoftware.com/terms/gdpr-statement</a></td></tr></tbody></table>

## AI security and governance

Phocas AI is designed to work securely with your business data, while respecting your existing access and permissions.

Learn more about AI capabilities in our platform and the Phocas Trust Layer – the security and governance framework for all AI in Phocas:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden></th><th data-hidden data-card-cover data-type="image">Cover image</th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Phocas AI</strong></td><td>Learn about AI in Phocas, including how it works with your business data and the AI features available across the platform</td><td></td><td><a href="https://4232616215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqRvX8Eg8GftkyP0R8RVU%2Fuploads%2FRUKgp3v7bA770H2iCXuw%2FPhocas%20AI-hero.jpg?alt=media&amp;token=4f87ba6d-58ac-4bb5-a97e-4b4df631270c">Phocas AI-hero.jpg</a></td><td><a href="https://www.phocassoftware.com/ai">https://www.phocassoftware.com/ai</a></td></tr><tr><td><strong>Phocas Trust Layer</strong></td><td>Learn how the Phocas trust layer brings together permissions, business context and security controls to protect your data in Phocas</td><td></td><td><a href="https://4232616215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqRvX8Eg8GftkyP0R8RVU%2Fuploads%2FiSnmP3PJi5OTk1RF75xR%2Ftrust-layer-hero-shield-only.svg?alt=media&amp;token=746e2335-d290-4748-9f66-2f3aff411ee9">trust-layer-hero-shield-only.svg</a></td><td><a href="https://www.phocassoftware.com/ai/trust-layer">https://www.phocassoftware.com/ai/trust-layer</a></td></tr></tbody></table>

## Session timeout overview

When using Phocas, your session stays active for a while, so you don’t need to sign in repeatedly. However, to help protect your data and ensure system security, user sessions are designed to automatically expire (time out) after periods of inactivity or in specific situations. When this happens, you need to sign in again to continue working.

Your session can expire for several reasons, including but not limited to the following situations. Please note that this list is subject to change.

* When your administrator:
  * Forces you to sign out
  * Locks or deletes your user account
  * Changes your username or password
* After a set time period:
  * Each session will automatically expire after 12 hours
  * If you [impersonate another user](/administration/users/impersonate-a-user.md), the impersonation session will timeout after 1 hour

## Multi-factor authentication

Phocas doesn’t natively support multi-factor authentication (MFA), but if you’re looking for that level of security, you can [set up single-sign on (SSO)](/administration/configuration/set-up-sso.md) for your Phocas site.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.phocassoftware.com/other-information/security-information.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.