# 1. Login & Security

User Type: **CSR**
Source: *Mi Digital Academy - Education CRM Features Document*

---

## 1. Login & Security

### 1.1 Secure Login
**What it does:** Lets the CSR representative sign in to the CSR portal with email and password, with OTP verification and two-factor authentication. This is the entry point to all CSR features.

**Sub-features:**
- Email + password login
- OTP verification on login
- Two-factor authentication (2FA)
- Password reset via email link
- Session timeout and auto-logout
- Secure Login available on web and mobile
- secure login event logging (viewed)
- Audit logging of secure login

**CSR User Journey:**
1. CSR navigates to Secure Login.
2. CSR reviews the secure login details shown.
3. CSR performs the primary action for secure login.
4. CSR confirms the result matches the documented behavior.
5. CSR opens Profile → "Activity" and confirms the events are recorded.

**Rules & Edge Cases:**
- Email + password login.
- OTP verification on login.
- Two-factor authentication (2FA).
- Password reset via email link.
- Session timeout and auto-logout.

### 1.2 Registration & Verification
**What it does:** Lets a company register a CSR account, submit organization details, and get verified by the platform before funding programs. Only verified accounts can fund programs.

**Sub-features:**
- CSR account registration form (company name, registration number, contact)
- Organization document upload (certificate of incorporation, CSR policy)
- Platform verification and approval workflow
- Email verification of the CSR contact
- Account status: pending, verified, suspended
- Registration & Verification available on web and mobile
- registration & verification event logging (viewed)
- Audit logging of registration & verification

**CSR User Journey:**
1. CSR navigates to Registration & Verification.
2. CSR reviews the registration & verification details shown.
3. CSR performs the primary action for registration & verification.
4. CSR confirms the result matches the documented behavior.
5. CSR opens Profile → "Activity" and confirms the events are recorded.

**Rules & Edge Cases:**
- CSR account registration form (company name, registration number, contact).
- Organization document upload (certificate of incorporation, CSR policy).
- Platform verification and approval workflow.
- Email verification of the CSR contact.
- Account status: pending, verified, suspended.