Account - Multi-Factor Authentication (MFA) Implementation

Introduction

In today’s increasingly connected digital environment, safeguarding user accounts and sensitive business data is paramount. With the rise of credential-theft, phishing attempts, and unauthorized access incidents, relying solely on a username and password is no longer sufficient.
To elevate security across our platform, we will be rolling out Multi-Factor Authentication (MFA) for all user accounts. This extra layer of protection will become mandatory in early 2026, and we strongly encourage all users to prepare ahead of time.

What is Multi-Factor Authentication (MFA)?

Multi-Factor Authentication is a security process that requires two or more independent credentials to verify identity during login. These typically include:

• Something you know (your password)
• Something you have (for example, a code sent to your phone or email)
  By combining multiple factors, MFA significantly reduces the risk of unauthorized access—even in the event of a compromised password.

In the software, MFA will operate as follows:

1. You enter your usual login credentials (email + password).
2. You will receive a one-time code via email or SMS (text) to your registered contact method.
3. You must enter that code to complete login.
4. Once you login with that code, we will clear your device for 90 days or until you clear cookies. If you are using a private or incognito window or other privacy/security features, you may have to perform the MFA each time you login.  

Even if someone obtains your password, they would still need access to your email or phone to log in.

Why Are We Implementing MFA?

There are several key reasons behind the decision to implement MFA:

• Enhanced Account Security: MFA adds a second verification step, dramatically improving protection against unauthorized access.
• Defense Against Modern Threats: Common attack vectors like phishing, credential stuffing, and brute-force attacks are thwarted by requiring an additional factor beyond passwords.
• Industry Standards & Compliance: Many industries now regard MFA as a best practice—or even a requirement—to meet data protection obligations.
• Protecting You & Our Platform: By strengthening login security, we help ensure that your business and customer data remain secure, enhancing trust and reliability for everyone using the software.

How It Works (Step-by-Step)

Here’s what you can expect when MFA is activated for your account:

1. Contact Verification Prompt
   Upon first login after MFA activation (or upon entering the new rollout phase), you will be asked to confirm your email address and phone number as shown in the screenshot above.
   
2. Receive Verification Code
   After confirming your contact details, you will receive a one-time verification code via your selected method:
   • Email: Sent to your registered email address
   • SMS: Sent to your registered mobile phone number

     

3. Enter the Code and Access Your Account
   Enter the code on the login screen. Once verified, you will successfully log in with MFA enabled.
4. Updating Contact Info
   If you change your phone number or email, you will need to update your account settings before next login. The sent verification code will go to whatever contact info is on file.

Rollout Timeline & Mandatory Implementation

We will roll out MFA over a phased schedule to minimize disruption and give you ample time to prepare.

Action required now: Please verify your email and phone number as soon as possible to ensure you are ready when MFA becomes mandatory.

Preparation Checklist

To ensure a smooth transition, please take the following steps ahead of time:

• Log in to your account.
• Navigate to Account Settings and confirm your email address is correct and accessible.
• Confirm your mobile phone number is accurate and you have access to receive text messages.
• If you have unsubscribed from system emails or SMS, consider re-enabling them (you’ll only receive authentication codes, not marketing).
• Familiarize yourself with how the verification code is delivered and entered.
• Make sure you have access to one of the methods (email or phone) whenever you log in.

Completing these steps ahead of time helps avoid delays or login issues once MFA is mandated.

FAQ (Frequently Asked Questions)

Q: What happens if I don’t verify my contact information before the mandatory date?
A: Once MFA becomes mandatory, you will be required to set it up at login. If your contact info is outdated or missing, you may be unable to access your account until you update it.

Q: Do I need to enter a code every time I log in?
A: Not necessarily. If you mark a device as trusted, you may skip code verification for a period of 90 days. However, logging in from a new device, clearing browser data, or using incognito mode will trigger MFA again.

Q: Can I choose both email and phone for receiving codes?
A: You will need to select at least one method (email or phone). Some accounts may allow you to receive via both, but only one code is required each login.

Q: What if I lose access to my phone or email?
A: If you lose access to your registered contact method, please contact our Support team immediately. They will assist in verifying your identity and updating your contact information.

Q: Is this required for all users or only administrators?
A: MFA will be required for all user accounts—administrators and worker logins alike.

Support & Resources

Our support team is here to help you throughout the rollout of MFA. We will provide:

• Step-by-step how-to guides
• FAQs and troubleshooting tips

For assistance, please contact the software's Support team. They can assist with verifying contact info, resolving login issues, or walking you through the MFA process.

Summary & Your Action Items

To recap:

• MFA is a critical security upgrade that will become mandatory in early 2026.
• You need to verify your email and phone number now to be prepared.
• When required, you’ll receive a code by email or SMS as part of your login.
• Failure to set up MFA may result in login blockage once the mandatory phase arrives.