The Account Management Panel,
documented in Retain 4.10: Configuration and Administration, lets you control:
When/how new accounts are created.
When accounts expire.
Which users can log in.
How strong passwords must be (except when overridden by associated messaging systems).