Sign in
TCP has two separate sign-in entry points for two different roles. Pick yours.
Analyst
Address and flow analysis, multi-address intersection, case investigation, labelling, watchlists and alerts. This is the product itself.
- Identity realm
- TCP-ANALYSTS
- Host
- app-v2.tcp.enlightenmentlab.dev
Platform administration
People and permissions, data management, system health, third-party service usage, label governance, audit log.
- Identity realm
- TCP-ADMIN
- Host
- admin-v2.tcp.enlightenmentlab.dev
Why is an analyst account a different account from an admin account?
Because they live in two separate identity realms. If the same human is both an analyst and an administrator, that human has two accounts, two passwords and two second factors. This is not a bug. It is a deliberate security boundary.
A token minted for one realm is rejected outright by the other. That means a workbench token cannot be used against the admin console even if somebody obtains it — and a privilege escalation on the admin side does not quietly become a privilege on the analyst side.
The cost is that you keep two sets of credentials. We think that trade is worth it, but we are not going to pretend it costs nothing.
What happens on your first sign-in
- Both realms allow self-registration.
- Email verification is required before first use.
- Both realms enforce TOTP one-time passwords at login (6 digits, 30-second period). You will be asked to enrol on your first sign-in.
- An analyst can use the product immediately after registering. An admin registrant lands in a pending-approval group with no role and must be approved by an existing administrator — until then you will see a pending-review page.
- Both realms support forgotten-password recovery.
- Minimum password length: 12 characters for analysts, 14 for administrators.
This site itself has no login
The public entry site you are reading has no sign-in and registers no identity client of its own. The two buttons above are ordinary links: authentication happens entirely in the application you are taken to and on the identity server behind it.