This article covers all security features available in Vemcount — two-factor authentication, browser session management, company-wide password policies, and API key generation. These settings are critical for GDPR compliance and account protection.

Two-factor authentication (2FA)

Path: Avatar (top-right) → User Settings → Security tab

Enable or disable 2FA per user from the Security tab
When active, the tab shows a Show recovery codes button — download and store these. Recovery codes are one-time backup codes used if the 2FA device is lost
Click Disable to turn off 2FA (requires current 2FA code to confirm)

Important: If a user loses their 2FA device and has no recovery codes, an Admin must deactivate and re-create their account. Always encourage users to save their recovery codes when enabling 2FA.

Browser session audit & revoke (GDPR)

Path: Avatar → User Settings → Security tab → Browser sessions

The browser sessions section shows a full audit log of every active login session for the account:

Browser column — full user-agent string including browser name, OS, and version
IP address column — the IP address used for that session
Red trash icon — revoke any individual session immediately

Use this to revoke access if a device is lost or stolen, or to identify unexpected logins from unknown locations as part of GDPR session management.

Company-wide password policy

Path: ⚙ Settings → Companies → [Company] → Employee Settings → Password Policy

Three configuration sections:

Rules

Minimum password length

Set minimum character count

Must contain letters

Toggle — require at least one letter

Must contain numbers

Toggle — require at least one number

Must contain uppercase

Toggle — require at least one uppercase letter

Must contain special characters

Toggle — require at least one special character (!@#$% etc.)

Expiration

Enable password expiration

Toggle — forces all users to change password after the set period

Require admin to reset expired passwords

Toggle — when on, expired-password users cannot self-reset; Admin must do it

Password expiration period

Number field — days until password expires (e.g. 90)

Extra security

Allow users to change their own password

Toggle (default ON) — disable to prevent self-service password changes

Require two-factor authentication

Toggle — enforces company-wide 2FA for ALL users in this company. Users cannot log in without 2FA once enabled

Password must not have appeared in data leaks

Toggle — checks submitted passwords against known breach databases (Have I Been Pwned). Rejects compromised passwords

API key generation

Path: Avatar → User Settings → API key tab

Shows the user's personal API key (masked by default)
Click Generate new key to create or rotate the API key
The API key authenticates requests to the Vemcount REST API for external integrations, data exports, and BI tool connections

Security note: Treat your API key like a password. Do not share it or commit it to code repositories. If compromised, generate a new key immediately — the old key is invalidated instantly.

SSO / OAuth (Microsoft Azure)

SSO is configured per white-label brand via the Branding settings. The OAuth section contains a Microsoft Azure toggle — when enabled, users of that brand can sign in via Azure AD / Entra ID instead of username and password. See the White-label branding & feature toggles article for full configuration.

GDPR orphaned user cleanup

Path: ⚙ Settings → Companies → [Company] → Location Management → GDPR

Shows users who have no active locations connected — an orphaned-user cleanup tool for GDPR compliance. Columns: User, ID, Location, Opening Date, Active Date, Closing Date, Deactivate Date, Contract Termination. Use this to identify and deactivate users whose locations have closed, per data-retention obligations.

7PM

GMT+2

7PM

GMT+2

7PM

GMT+2

Who We Are

Aliquam Dui Diam, Tincidunt Eget Nulla Eget, Dictum Feugiat Felis. Cras Mattis Eget Tellus Quis Fringilla. Morbi Molestie Enim

Aliquam dui diam tincidunt eget nulla eget dictum feugiat felis.