Work-A-Beez Password and Credential Policy

Version 1.1 · Last updated: September 07, 2026

This page describes the password and credential requirements currently used by Work-A-Beez and distinguishes enforced controls from recommended practices and roadmap items.

Organization administrator passwords

New organization-administrator accounts created through the current signup flow must use a password that:

is at least 12 characters long;
contains at least one uppercase letter;
contains at least one lowercase letter;
contains at least one number; and
contains at least one special character.

Passwords are not intentionally stored in plaintext. Work-A-Beez stores one-way password hashes generated by the application.

Legacy and other account flows

Some existing accounts or account-management flows may have been created under earlier password rules. This public policy does not represent that every legacy credential was automatically revalidated against the current signup standard. LBS may strengthen or harmonize credential requirements over time.

Employee clock-in PINs

Employee clock-in PINs are separate credentials from organization-administrator passwords and are stored using one-way hashing. Customers should issue unique PINs that are difficult to guess, avoid obvious sequences, and change a PIN when compromise is suspected.

Recommended password practices

Use a unique Work-A-Beez administrator password that is not reused on another service.
Use a reputable password manager where practical.
Do not share administrator credentials with coworkers or support personnel.
Change a password promptly if compromise is suspected.
Sign out after using a shared device.
Protect the email account associated with the Work-A-Beez administrator account because email may be involved in account recovery.

Controls not currently represented as universally enforced

Unless LBS separately confirms a feature in writing, Work-A-Beez does not currently represent that the following controls are universally enforced across all customer account types:

customer-facing multi-factor authentication (MFA);
SAML/OIDC single sign-on;
scheduled password expiration;
password-history or password-reuse blocking;
customer-configurable password policies; or
a universal hard account lockout after a fixed number of failed attempts.

Selected authentication paths use rate limiting to reduce automated login abuse.

Multi-factor authentication

MFA is a planned enhancement and is not generally available to Work-A-Beez customers today. Customers should not state that MFA is enabled in their Work-A-Beez environment unless LBS has confirmed the feature is available for that environment.

Credential compromise

If an administrator believes a password, employee PIN, authorized-device token, or related credential has been exposed, the Customer should change or revoke the affected credential where the product allows, remove unnecessary device/user access, and contact info@lbsconnect.net if additional assistance is required.