Two-factor authentication (2FA)

Path: Avatar (top-right) → User Settings → Security tab

• Enable or disable 2FA per user from the Security tab

• When active, the tab shows a Show recovery codes button — download and store these. Recovery codes are one-time backup codes used if the 2FA device is lost

• Click Disable to turn off 2FA (requires current 2FA code to confirm)

Browser session audit & revoke (GDPR)

Path: Avatar → User Settings → Security tab → Browser sessions

The browser sessions section shows a full audit log of every active login session for the account:

• Browser column — full user-agent string including browser name, OS, and version

• IP address column — the IP address used for that session

• Red trash icon — revoke any individual session immediately

Use this to revoke access if a device is lost or stolen, or to identify unexpected logins from unknown locations as part of GDPR session management.

Company-wide password policy

Path: ⚙ Settings → Companies → [Company] → Employee Settings → Password Policy

Three configuration sections:

Rules

Expiration

Extra security

API key generation

Path: Avatar → User Settings → API key tab

• Shows the user's personal API key (masked by default)

• Click Generate new key to create or rotate the API key

• The API key authenticates requests to the Vemcount REST API for external integrations, data exports, and BI tool connections

SSO / OAuth (Microsoft Azure)

SSO is configured per white-label brand via the Branding settings. The OAuth section contains a Microsoft Azure toggle — when enabled, users of that brand can sign in via Azure AD / Entra ID instead of username and password. See the White-label branding & feature toggles article for full configuration.

GDPR orphaned user cleanup

Path: ⚙ Settings → Companies → [Company] → Location Management → GDPR

Shows users who have no active locations connected — an orphaned-user cleanup tool for GDPR compliance. Columns: User, ID, Location, Opening Date, Active Date, Closing Date, Deactivate Date, Contract Termination. Use this to identify and deactivate users whose locations have closed, per data-retention obligations.