Security & MFA¶

Multi-factor authentication (MFA) adds a second layer of protection to every login. Even if a password is compromised, an attacker cannot access your account without the time-based code from your authenticator app.

MFA is available on all plans — Free, Pro, and Enterprise.

What is MFA?¶

MFA uses the TOTP (Time-based One-Time Password) standard. After entering your password, you provide a 6-digit code generated by an authenticator app on your phone. The code changes every 30 seconds.

Compatible authenticator apps¶

Any TOTP-compatible app works with FSM Navigator, including:

Enabling MFA for your account¶

Any user can enable MFA for their own account, regardless of role.

1. Click your name in the top-right corner.
2. Select Security from the dropdown.
3. Click Enable MFA.
4. A QR code is displayed. Open your authenticator app and scan it.
5. Enter the 6-digit code from the app to verify the setup.
6. Click Save.

Disabling MFA¶

If you need to disable MFA (e.g., switching phones):

1. Go to Profile → Security.
2. Click Disable MFA.
3. Confirm with your current 6-digit code.

Company-wide MFA enforcement¶

Owners can require every user in the company to set up MFA. This is the strongest way to protect your organization against unauthorized access.

Enabling enforcement¶

1. Navigate to Settings → Security & MFA.
2. Toggle Require MFA for all users to On.
3. Set the enforcement date — the date from which the policy takes effect.
4. Set the grace period — the number of days users have to set up MFA after the enforcement date.
5. Click Save.

How the grace period works¶

The grace period gives your team time to set up their authenticator apps before enforcement kicks in.

During the grace period:

• Users see a banner reminder on every page encouraging them to set up MFA.
• Users can still log in normally while the grace period is active.
• Reminder emails are sent at 48 hours, 24 hours, and 12 hours before the deadline.

What happens when the grace period expires¶

Once the deadline passes, any user who has not set up MFA will be required to complete setup on their next login:

1. The user enters their password and logs in.
2. A mandatory MFA setup screen appears — it cannot be dismissed.
3. The user must scan the QR code and verify a 6-digit code.
4. Only after successful verification can they access the dashboard.

Checking compliance status¶

Owners can monitor which team members have completed MFA setup:

1. Go to Settings → Security & MFA.
2. View the MFA Compliance section.
3. Each user is shown with their status:

Status	Meaning
Enabled	MFA is active and verified
Pending	User has not yet set up MFA (within grace period)
Overdue	Grace period expired — user will be forced to set up on next login
Exempted	User is exempt from the MFA requirement

Exempting specific users¶

In some cases, you may need to exempt a user from the MFA requirement — for example, a shared kiosk account or a temporary contractor.

1. Go to Settings → Security & MFA.
2. Find the user in the compliance list.
3. Click the Exempt toggle next to their name.
4. Confirm the exemption.

To revoke an exemption, toggle the switch off. The user's grace period starts from that moment.

Frequently asked questions¶

Next steps¶

• Configure your company profile to complete your account setup.
• Invite your team and assign roles.
• Review plans and pricing to explore advanced security features.