Security & MFA

Multi-factor authentication (MFA) adds a second layer of protection to every login. Even if a password is compromised, an attacker cannot access your account without the time-based code from your authenticator app.

MFA is available on all plans — Free, Pro, and Enterprise.

What is MFA?

MFA uses the TOTP (Time-based One-Time Password) standard. After entering your password, you provide a 6-digit code generated by an authenticator app on your phone. The code changes every 30 seconds.

Compatible authenticator apps

Any TOTP-compatible app works with FSM Navigator®, including:

Enabling MFA for your account

Any user can enable MFA for their own account, regardless of role.

1. Click your name in the top-right corner.
2. Select Security from the dropdown.
3. Click Enable MFA.
4. A QR code is displayed. Open your authenticator app and scan it.
5. Enter the 6-digit code from the app to verify the setup.
6. Click Save.

Disabling MFA

If you need to disable MFA (e.g., switching phones):

1. Go to Profile → Security.
2. Click Disable MFA.
3. Confirm with your current 6-digit code.

Company-wide MFA enforcement

Owners choose a sign-in requirement for everyone in the company. There are three options:

Choosing a requirement

1. Navigate to Settings → Security & MFA.
2. Under Sign-in requirement, pick an option.
3. Set the enforcement date — the date from which the policy takes effect.
4. Set the grace period — the number of days users have to set up the required sign-in method after the enforcement date.
5. Click Save. If the change raises the requirement, a confirmation first tells you how many people will need to set it up. Cancel leaves everything as it was.

When you raise the requirement and set an enforcement date, each person who still needs to set it up gets one email with their deadline. Without an enforcement date nobody gets a deadline or an email yet. If FSM Navigator cannot check who the change affects, nothing is saved and you can try again. Anyone whose deadline from an earlier requirement has already passed gets a fresh grace period, counted from the enforcement date or from today, whichever is later.

How the grace period works

The grace period gives your team time to set up their authenticator apps before enforcement kicks in.

During the grace period:

• Users see a reminder banner at the top of each page with their deadline and a link to set it up. They can dismiss it for the rest of their visit.
• Users can still log in normally while the grace period is active.
• Reminder emails are sent at 48 hours, 24 hours, and 12 hours before the deadline.

What happens when the grace period expires

Once the deadline passes, a user who has not set up the required sign-in method can no longer sign in the normal way. This applies to every way of signing in: with a password, and with Google, Microsoft, or Apple.

What they see instead is a short set-up session. They enter their password (or sign in with their provider), then a 6-digit set-up code we email them, and a Set up two-step sign-in screen opens. There they add a passkey or an authenticator app, and when they finish they are signed out and sign in again with their new second step. The session lasts up to 15 minutes and does nothing else, so you don't need to do anything for most people. The same works in the mobile app. Steps for your team are in Multi-factor authentication.

Anyone who is still signed in when their deadline passes is signed out at their next action. A person who has set up an authenticator app but is still signed in with only a password is signed out once and asked to sign in again with their code.

If someone can't get the set-up code because their email address is wrong or they've lost access to that mailbox, you have two options. You can change their sign-in email to an address they can read, or you can exempt them so they can sign in without it. You can only change a team member's address. If an Owner's mailbox is the problem, that Owner contacts FSM Navigator support, because an Owner can't change another Owner's sign-in email or their own.

Keeping a second step

While a requirement is on, people cannot turn off their authenticator app themselves when it is their only second step. If someone needs to replace it, an Owner can reset it for them. That restarts their grace period. An Owner cannot reset their own, so a sole Owner contacts support.

Connecting an AI app also needs a two-step sign-in while the requirement is on.

Checking compliance status

Owners can monitor which team members have completed MFA setup:

1. Go to Settings → Security & MFA.
2. View the MFA Compliance section.
3. Each user is shown with their status:

Status	Meaning
Enabled	MFA is active and verified (also when the user is exempted)
Pending	User has not yet set up MFA (within grace period)
Overdue	Grace period expired — user can only sign in to set up the required method, unless they are exempted
Exempted	User has no MFA and is exempt from the requirement

Exempting specific users

In some cases, you may need to exempt a user from the MFA requirement — for example, a shared kiosk account or a temporary contractor.

1. Go to Settings → Security & MFA.
2. Find the user in the compliance list.
3. Click the Exempt toggle next to their name.
4. Confirm the exemption.

To revoke an exemption, toggle the switch off. The user's grace period starts from that moment.

If an Owner removes a user's authenticator app while a requirement is on and an enforcement date is set, that user gets a new deadline: the full grace period, counted from the enforcement date or from the moment of removal, whichever is later. This gives them time to set up a new one.

Frequently asked questions

Next steps

• Configure your company profile to complete your account setup.
• Invite your team and assign roles.
• Review plans and pricing to explore advanced security features.