Content move

docs/vendor/vendor-password-integrity.mdx

@@ -0,0 +1,12 @@
+# Vendor Password Integrity
+
+This topic describes how Replicated stores your Vendor Portal account password.
+
+## Vendor Portal Account Password
+
+Replicated stores your account password as a bcrypt hash with a cost parameter of 10. This is a non-reversible method that ensures that nobody can view your plain text password.
+
+When you log in, your password is sent to our servers where we calculate a bcrypt hash of the entered password and compare that to the hash we have stored in our database. If these match, access to your account is granted and you are logged in.
+
+The only time we have access to your plain text password is at login and when you change or update your password. During this time, we also calculate a separate, non-reversible hash of your password and [compare it to a list of password hashes](https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/) that are known to have been compromised from other providers. If your password hash is on this list, we will alert you with a banner and a warning. We recommend that you change your password to a securely generated password, preferably one that is not re-used or shared on other sites. We never send your password or the full hash of your password to anyone, including when checking if your password has been compromised.
+

docs/vendor/vendor-portal-creating-account.md

@@ -41,6 +41,8 @@ To create a vendor account:
    Replicated recommends that you use a temporary application name for testing because you are not able to restore or modify previously-used application names or application slugs in the Vendor Portal.
    :::
 
+For more information on how Replicated stores your username and password information, see [Vendor Portal Account Password Integrity](/vendor/vendor-password-integrity).
+
 ## Next Step
 
 Invite team members to collaborate with you in Vendor Portal. See [Invite Members](team-management#invite-members).

sidebars.js

@@ -878,6 +878,7 @@ const sidebars = {
         href: 'https://www.replicated.com/security/'
       },
       'enterprise/sbom-validating',
+      'vendor/vendor-password-integrity',
       'vendor/replicated-sdk-slsa-validating',
     ],
   },