Zircon CRM / Administration
Runs in the browser · HU / EN / DETwo-factor authentication, reCAPTCHA and a login audit trail
Zircon CRM holds your customers, contracts and invoices, so it matters who can log in. Staff can add an e-mailed code or an authenticator app to their password, and reCAPTCHA guards the login pages and public forms. Login attempts go into the activity log with their IP address.
E-mail code or authenticator appOne-hour password reset linksLogin log with IP addresses
In short
How does Zircon CRM protect the login?
Zircon CRM protects the login in layers. Staff can switch on two-factor authentication: after the password, the system asks for a single-use code sent by e-mail or a six-digit code from an authenticator app. reCAPTCHA guards the login pages and public forms, and logins and failed attempts are logged with IP addresses. It is built for administrators and owners.
Sound familiar?
One password stands in front of your customer data.
If one of these rings true, the login is a weak spot for your team.
- 01
The same password in five places
A sales rep uses the same password for the CRM as for a webshop that was breached years ago. If it leaks, the password alone gets someone in.
- 02
No trace of who logged in
You find an odd change on a customer record, but you cannot check who logged in that day, or from where.
- 03
Bots fill in your forms
Automated submissions land on the registration and quote forms every day, and someone deletes them by hand.
- 04
The reset link lives for weeks
An old password reset e-mail in an inbox would still let in anyone who can read it, weeks later.
What it does
How Zircon CRM protects the login and what comes after it.
Protection starts at the login and carries on through accounts, links and stored secrets.
Two-factor authentication by e-mail code or app
Each staff member chooses on their own profile: disabled, e-mail code or authenticator app. The e-mail code is valid for one hour and works once. The app option follows the TOTP standard, so any compatible authenticator works, and wrong codes are logged with the IP address.
Deactivation takes effect at once
An inactive staff member or customer contact cannot log in. A staff member who is already logged in is signed out at their next click.
Short-lived links and sessions
Password reset links are valid for one hour, set-password links sent to contacts for 48 hours and e-mail verification links for two days. Sessions expire after 8 hours of inactivity by default, and "Remember me" is tied to the browser it was created in.
reCAPTCHA and honeypot fields
Google reCAPTCHA protects the staff and customer logins, customer registration, the public ticket form and any web-to-lead or quote request form where you switch it on. Office IP addresses can skip the check. Hidden honeypot fields also filter customer self-registration.
Passwords and secrets stay unreadable
Staff and contact passwords are stored as one-way bcrypt hashes, so not even an administrator can read them. Mailbox passwords, OAuth client secrets and authenticator keys are stored encrypted with your installation's own key.
Login audit trail
The activity log records successful and failed logins, attempts with unknown e-mail addresses, failed second steps and password resets, with date and IP address. Only administrators can see it, and they can filter it by date.
Protected document links
You can make shared invoice, estimate and contract links open only for logged-in portal users. The public ticket link can be switched off.
Protection inside the application
Every form and data request carries a security token against cross-site request forgery (CSRF). Uploads are limited to the file types you allow, with a separate list for ticket attachments.
How it works
Five steps to a sound baseline.
- 01
Set up outgoing e-mail
Preferably with Microsoft or Gmail OAuth 2.0, so no mailbox password has to be stored. E-mail codes and reset links travel this way.
- 02
Enter your reCAPTCHA keys
Switch reCAPTCHA on for the customer login and registration, and on every public lead or quote request form.
- 03
Decide on self-registration
Turn it off, or require administrator approval and e-mail verification.
- 04
Ask the team to add the second step
Ask every staff member to switch it on in their profile, preferably with an authenticator app.
- 05
Review the log regularly
Filter the activity log by date and watch for failed logins and unfamiliar IP addresses.
Works with
It still matters after the login.
- Roles and permissionsonce someone is in, their role and permission grid decide what they can see and change.
- Staff and teamsactivating, deactivating and deleting accounts and the second-step setting live on the staff profile.
- GDPR and privacythe terms customers accept at registration come from the GDPR settings.
- Web-to-lead formsreCAPTCHA, switched on per form, filters automated submissions.
- E-mail templates and notificationsthe e-mail code and password reset templates, and the OAuth mail sending setup.
- MCP server for AI assistantsAI assistants connect with OAuth 2.1 or a personal token and work with the staff member's permissions.
Honestly
Good to know before you start.
Two-factor login is a choice per staff member. It cannot be made mandatory, and it is not available for customer portal contacts.
Zircon CRM does not lock an account after failed attempts and does not limit the number of attempts. The login is protected by the second step, reCAPTCHA and the login audit trail.
E-mail codes and reset links need working outgoing e-mail, the authenticator app needs an image-processing extension on the server, and reCAPTCHA needs Google reCAPTCHA keys.
Administrators can clear the activity log, so the log is only evidence for as long as nobody empties it.
Session length and cookie security settings come from the server configuration, not from the interface.
Before you write
Fair questions. Straight answers.
- 01
Can I make two-factor authentication mandatory for all staff in Zircon CRM?
No. In Zircon CRM each staff member chooses on their own profile whether to use an e-mail code or an authenticator app after the password. Because it cannot be enforced, it is worth setting it up together with everyone during rollout.
- 02
Which authenticator apps work with Zircon CRM?
Zircon CRM uses the TOTP standard, so Google Authenticator and any compatible authenticator app work. During setup you get a QR code and a secret key for manual input, and the QR code carries your company name.
- 03
Can an administrator see staff passwords in Zircon CRM?
No. Zircon CRM stores passwords as one-way bcrypt hashes that nobody can read. An administrator can set a new password, and staff change their own on their profile after entering the old one.
- 04
What happens when someone tries to log in to Zircon CRM with a wrong password?
Zircon CRM refuses the login with a generic message that does not reveal whether the account exists, and logs the attempt with the e-mail and IP address. There is no account lockout, so switch on the second step: with it, a password alone is not enough.
- 05
What protects the customer portal login in Zircon CRM?
reCAPTCHA on login and registration, honeypot fields on self-registration, and e-mail verification and administrator approval for new registrations. Inactive contacts cannot log in. Two-factor login is not available for contacts.
Let's talk.
The first call costs nothing
A human replies — not a bot
Bring your current password and access rules, if you have any. In the demo we walk through a login with an authenticator app and show you what the log records when someone gets the password wrong.
- hello@zircon.hu
- Phone
- +36 30 487 7979
- Hours
- Weekdays 9–17
- Support
- support@zircon.hu (existing clients)