All authentication attempts are logged to an immutable audit trail. Sessions expire automatically per your organisation's policy. Credentials are never transmitted in plaintext.