Sign in to BASSMA

Internal dashboard — authorized staff only.

Email

Password

Encrypted connection · BASSMA

Your catalogue, protected.

BASSMA holds the rights, royalties and delivery history for every release on your label. Access is locked down accordingly.

Passwords are never storedOnly a scrypt hash is kept, with a per-account salt. Sign-in takes the same time whether or not an account exists, so the form cannot be used to discover who has one.
Five attempts, then a pauseRepeated failures lock the account for 15 minutes. Every attempt, successful or not, is written to an audit log with its IP and device.
Sessions are signed and shortAn HttpOnly, SameSite cookie holds a signed token that expires after 8 hours and can be revoked server-side. JavaScript can never read it.