How Market Monster protects your account.
Market Monster supports passkeys and authenticator-app two-factor, and requires one of them before a workspace owner or admin changes anything. Passwords are hashed with scrypt and checked against known breaches, and an account locks after 5 failed sign-ins. This page lists only controls that are in the product today.
Updated
The controls in the product today.
Report a security issue to support@marketmonster.io.
| Control | How it works |
|---|---|
| Passkeys | Sign in with a passkey stored on your device or in your password manager, with no password to type. |
| Two-factor authentication | A time-based code from an authenticator app, or a passkey. No SMS codes. |
| Two-factor for owners and admins | Workspace owners and admins must turn on two-factor or add a passkey before they invite people, change roles or change settings. |
| Password storage | A salted scrypt hash. Plain-text passwords are never stored. |
| Breached-password check | New passwords are checked against the Have I Been Pwned list and refused if they appear in a known breach. |
| Brute-force protection | An account locks for 15 minutes after 5 failed sign-ins, and sign-in attempts are rate limited. |
| Email verification | Every account email is verified before use. Magic links expire after 10 minutes and are never sent to an account with two-factor on. |
| Access control | Invitation-only workspaces with four roles: owner, admin, member and viewer. |
| Audit log | Sign-ins and other security events are recorded for review. |
Security questions
Who can see my business data in Market Monster?
Only people you invite. Each business gets its own Market Monster workspace, and a person can sign in to it only after accepting an email invitation. Inside the workspace every member has a role, and roles grant specific permissions, so a contractor sees what they need and nothing more.
Does Market Monster support two-factor authentication?
Yes. Market Monster supports two-factor authentication with an authenticator app or a passkey, and it does not use SMS codes. Owners and admins of a workspace must turn on two-factor or add a passkey before they invite people, change roles or change workspace settings.
How does Market Monster protect passwords?
Market Monster never stores your password, only a salted scrypt hash of it. New passwords are checked against the Have I Been Pwned list of breached passwords, sign-in attempts are rate limited, and an account locks for 15 minutes after 5 failed sign-ins.