---
title: Password Policy
slug: conversation-intelligence/password-policy
docTags: 
createdAt: 2026-02-24T11:35:23.446Z
---

# 1. Purpose

The CQA Password Policy defines the standards for creating, managing, and securing user passwords. This policy is designed to mitigate the risk of unauthorized access, brute-force attacks, and credential stuffing while maintaining a user-friendly experience that aligns with modern security standards (including NIST 800-63B guidelines).

# 2. Scope

This policy applies to all accounts accessing the CQA platform, including Tenant Administrators, Supervisors, Agents, and API system accounts.

# 3. Password Construction Requirements

All user-generated passwords must adhere to the following mandatory criteria:

## 3.1. Length Requirements

- **Minimum Length:** 12 characters.
- **Maximum Length:** 128 characters.
- *Rationale:* Longer passwords provide exponentially greater resistance against brute-force and dictionary attacks. Allowing up to 128 characters easily accommodates passphrases.

## 3.2. Character Complexity

Passwords must contain characters from at least **three (3) of the following four (4) categories**:

1. Uppercase alphabetical characters (A-Z)
2. Lowercase alphabetical characters (a-z)
3. Numeric characters (0-9)
4. Special characters and symbols (e.g., ! @ # $ % ^ & \* ( ) - \_ = + \[ ] \{ } ; : , . \< > / ?)

## 3.3. Allowed Characters

- The system supports **all UTF-8 characters**.
- Users are explicitly permitted to use spaces (allowing for multi-word passphrases) and all standard ASCII and non-ASCII symbols.

## 3.4. Contextual Restrictions

- **Username/Email Match:** Passwords are cross-checked against the user's account data. A password will be immediately rejected if it contains the user's username, first name, last name, or email address (evaluated as a case-insensitive substring match).

| **Security Parameter**      | **Requirement**             | **Description / Rule**                                                                                                                                                                                                  |
| --------------------------- | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Minimum Length**          | 12 Characters               | Passwords must be at least 12 characters long.                                                                                                                                                                          |
| **Maximum Length**          | 128 Characters              | Passwords can be up to 128 characters to easily accommodate long passphrases.                                                                                                                                           |
| **Complexity Requirements** | 3 out of 4 Categories       | Passwords must contain characters from at least 3 of the following 4 categories:<br />• Uppercase letters (A-Z)<br />• Lowercase letters (a-z)<br />• Numbers (0-9)<br />• Special characters/symbols (e.g., !@#$%^&\*) |
| **Allowed Characters**      | All UTF-8 Characters        | All standard characters, symbols, and spaces are explicitly allowed and encouraged.                                                                                                                                     |
| **Contextual Restrictions** | No Username/Email           | Passwords cannot contain the user's account username, first name, last name, or email address (case-insensitive).                                                                                                       |
| **Usability & Tools**       | Paste Functionality Enabled | The system fully supports copy/pasting.                                                                                                                                                                                 |