Authentication & Security

Enterprise-grade security with flexible authentication options and comprehensive protection

Overview

Instafill.ai's authentication system supports four sign-in methods: Google OAuth, Microsoft OAuth, email/password, and SSO (Enterprise). OAuth provider logic handles the identity exchange with Google and Microsoft without storing third-party passwords.

Passwords for email/password accounts are hashed using a strong adaptive hashing algorithm, which applies a cost factor during hashing so that plain-text credentials are never stored. After any successful authentication — regardless of method — the system issues a JWT. This token is then validated on every subsequent request by middleware running in both the API layer and the processing service, so the same credential is honored consistently across both service layers.

Two-factor authentication can be enabled at the user level or enforced across an entire organization, and adds an SMS verification step before the final JWT is issued. CAPTCHA protection via Cloudflare Turnstile is applied to email/password sign-ins to block automated credential attacks.

Key Capabilities

• Four Authentication Methods: Google OAuth, Microsoft OAuth, email/password with adaptive password hashing, and Enterprise SSO
• Unified JWT Issuance: A JWT is issued after successful authentication; the same JWT format is validated by both service layers
• Two-Factor Authentication: SMS codes delivered before the final JWT is issued; can be enforced organization-wide (Enterprise)
• CAPTCHA Protection: Cloudflare Turnstile applied to email/password sign-in flows to block bots and credential stuffing
• OAuth Provider Abstraction: Google and Microsoft flows handled by dedicated provider logic — both result in the same JWT output
• Session Management: JWTs carry workspace and role claims used by both service layers to enforce access boundaries
• Account Recovery: Secure password reset via email verification; backup codes available when 2FA is active
• Audit Logging: Authentication events — successful logins, failed attempts, 2FA challenges — recorded with timestamp and IP

How It Works

1. Sign-In Options: Users authenticate via one of four methods:

   • Google OAuth — Instafill.ai never receives the Google password; only the identity assertion is exchanged
   • Microsoft OAuth — same pattern; no Microsoft password is transmitted
   • Email/password — credential verified against a stored password hash
   • SSO (Enterprise) — organization-level identity provider configured by org admins

2. CAPTCHA Verification: Email/password sign-ins pass through Cloudflare Turnstile before credentials are checked, blocking automated login attempts.

3. 2FA Challenge (if enabled): After the first factor is verified, a 6-digit SMS code is sent. The final JWT is not issued until this code is confirmed.

4. JWT Issuance: On successful authentication, a JWT is issued containing the user identity, workspace membership, and role claims. This token is the single credential used across both service layers.

5. Ongoing Request Validation: Every API request presents the JWT to middleware in both service layers. The middleware verifies the token signature and extracts the workspace claim to enforce data isolation — no cross-workspace access is possible regardless of which service layer handles the request.

Use Cases

Authentication controls are the entry point for regulated-industry access policies. A healthcare practice filling CMS-1500 claims or I-485 immigration forms configures role-based workspace membership so clinical staff and billing teams access different form sets — the workspace isolation is enforced at the JWT claim level, not by convention. Law firms use workspace separation to maintain client matter confidentiality across teams handling similar form types (e.g., W-4 onboarding packets for different clients). Enterprises with distributed workforces enforce SSO and mandatory 2FA at the organization level so that all authentication flows through corporate identity standards without requiring per-user configuration.

Real-World Example: Healthcare organizations handling sensitive credentialing data have implemented secure workflows for multi-hospital physician credentialing with role-based access ensuring only authorized staff view completed credential packets.

Benefits

• Consolidated Token Format: The same JWT format is honored by both service layers, so there is no separate credential or session to manage
• No Plain-Text Password Storage: Adaptive password hashing means passwords cannot be recovered even from a database backup
• Provider Flexibility: Teams already using Google Workspace or Microsoft 365 authenticate with existing credentials — no new password to manage
• Enforcement at Scale: Organization-wide 2FA enforcement and SSO mean security policies apply uniformly to every member without per-user setup
• Compliance Logging: Authentication events are logged with timestamps and IP addresses to satisfy HIPAA technical safeguard documentation requirements
• Phishing Resistance: OAuth flows never transmit a password to Instafill.ai; SMS 2FA adds a second factor that phished passwords alone cannot bypass

Security & Privacy

All data is workspace-scoped and protected by JWT authentication middleware running across both service layers.

Password Security:

• Passwords are hashed using an adaptive algorithm; plain-text credentials are never stored or logged
• Minimum complexity requirements enforced at account creation and password reset

Session Protection:

• HTTP-only, Secure, SameSite cookies protect browser sessions from XSS and CSRF
• JWTs carry an expiration claim; expired tokens are rejected by middleware in both service layers
• Refresh tokens allow session continuity without re-entering credentials

Network Security:

• All authentication traffic encrypted with TLS
• IP address recorded on each authentication event for anomaly detection and audit purposes

Monitoring & Response:

• Progressive delays applied after repeated failed login attempts
• Cloudflare Turnstile blocks automated credential attacks on email/password endpoints
• Account lockout triggered after sustained failed attempts; account owner notified

Privacy:

• Google and Microsoft OAuth flows share only email and display name — no inbox or calendar access
• Authentication logs retain IP, timestamp, and success/failure outcome; no form content is logged at authentication time

Platform Updates: Enhanced data validation through field flagging and accuracy improvement features provides additional quality control layers for secure form processing.

Common Questions