Access & Identity

Password Reset

Available today

Self-service password recovery for Telblu accounts, powered by the platform's managed authentication service.

Password Reset lets users recover access to their Telblu account without contacting an administrator. Reset emails are dispatched by the managed authentication service, links are single-use and time-limited, and every request and outcome is captured in the application audit log for authorised organisation administrators.

Self-service request

Users start a password reset from the sign-in page. Telblu never reveals whether an email address is registered.

Managed reset link

The reset email is dispatched by Telblu's managed authentication service. Reset links are single-use and time-limited.

Enforced complexity

New passwords must meet Telblu's complexity policy before they are accepted, and are stored hashed by the managed authentication service.

Audit trail

Every request, successful change, invalid link and expired link is captured in the application audit log for authorised administrators.

Overview

Password Reset is available for Telblu accounts that authenticate with email and password. Users who authenticate through Google or through their organisation's SAML SSO manage credentials with those providers and should recover access there.

Telblu never handles, stores or logs plaintext passwords or reset tokens. All token generation, validation and password hashing are performed by the managed authentication service. Telblu is responsible for the user experience, the audit trail, and enforcing its password complexity policy on the client.

Reset flow

The workflow below shows how a password reset progresses from request through to the user signing in with their new password.

1. Request

The user selects Forgot password on the sign-in page and enters their work email. Telblu always responds with the same confirmation message.

2. Email dispatch

The managed authentication service generates a single-use, time-limited reset link and delivers it by email if the account exists.

3. Link validation

Following the link opens Telblu's Reset password page, which validates the recovery token with the managed authentication service.

4. New password

The user enters and confirms a new password that meets Telblu's complexity policy. Passwords are updated through the managed authentication service.

5. Recovery session ended

Telblu ends the recovery session and returns the user to the sign-in page so they can authenticate with their new password.

6. Sign-in resumed

The user signs in normally. Roles, organisation membership and Row-Level Security policies apply exactly as before.

User experience

The Password Reset pages reuse the sign-in visual language: same typography, components, form styling, validation patterns and loading states.

Forgot password link

A Forgot password link is available beside the password field on the sign-in page for accounts that use email and password.

Generic confirmation

The Forgot password page always shows: 'If an account exists for this email address, password reset instructions have been sent.'

Live password requirements

The Reset password page displays complexity requirements as the user types, so they can see when their new password becomes acceptable.

Clear failure states

Invalid and expired links show a plain-language explanation and offer a one-click Request a new link action.

Security considerations

Password reset is designed to prevent account enumeration and to keep sensitive material outside of Telblu's own code path.

No account enumeration

Requests return the same confirmation regardless of whether the email is registered. Server-side audit logging silently no-ops for unknown emails so response timing does not leak account existence.

Time-limited links

Reset links expire after a short window enforced by the managed authentication service. Expired links cannot be used to change a password.

Single-use tokens

Each reset link is valid for a single password change. Once used, or once a new link is issued, prior links are rejected.

No token storage in Telblu

Telblu never stores, transports or logs reset tokens. All token validation is performed by the managed authentication service.

Password complexity enforced

New passwords must satisfy Telblu's minimum length and character-class requirements before the managed service accepts them.

Session ends on change

The recovery session is terminated as soon as the password is updated. The user must sign in again with the new password to obtain a full session.

Password reset does not bypass Row-Level Security, organisation isolation or the role-based permission model. A user with a new password receives exactly the roles and workspace access they held before the reset.

Audit events

Every stage of the password reset flow is written to the application audit log under the authentication category. Reset tokens and passwords are never included in audit payloads.

Event	Severity	Description
password_reset_requested	Info	A password reset was requested for a known account. Recorded per organisation the user belongs to.
password_reset_completed	Info	A user successfully changed their password using a reset link.
password_reset_failed	Warning	A password change attempt failed after the user entered a new password (for example, the reset session was already terminated).
password_reset_invalid	Warning	A reset link was opened that was invalid or had already been used.
password_reset_expired	Warning	A reset link was opened after its expiry window closed.

Audit events are only recorded when Telblu can associate an event with a known account. Requests for unknown email addresses are silently dropped to prevent account enumeration through the audit trail.

Error handling

The reset experience is designed to fail gracefully. Users always see a clear, next- step-oriented message rather than a technical error.

Case	Behaviour
Unknown email address	Generic confirmation is shown. No email is dispatched. No audit event is written.
Known email, transport error	Generic confirmation is shown. The audit log records the request against the user's organisations.
Expired reset link	The Reset password page shows an expiry message with a link to request a new reset. An expired-link audit event is recorded when the email hint is available.
Invalid or already-used link	The Reset password page shows an invalid-link message with a link to request a new reset. An invalid-link audit event is recorded when the email hint is available.
Password does not meet complexity	The user cannot submit until requirements are met. No audit event is written because no attempt is sent to the managed service.
Managed service rejects update	The user sees the specific error returned by the managed service (for example, password reuse). A failed-attempt audit event is recorded.

Best practices

For end users

Use a password manager

Generate a unique password of at least 16 characters with your password manager and store it there. Do not reuse passwords across systems.

For end users

Act on reset emails quickly

Reset links expire quickly and are single-use. Complete the reset in the same browser session that you started the request in.

For administrators

Encourage SSO where available

For organisations with SAML SSO configured, prefer single sign-on to reduce password reset volume and shift credential management to your identity provider.