Security: sign-in log, password rules and two-factor sign-in
See every sign-in try, set password rules, ask for a second factor or a passkey, and limit sign-ins by network, device and hours. Settings can differ per Entity, and every part comes with every plan.
PLANSEvery plan
The problem it solves
- Nobody can tell who signed in last night, or from where.
- Staff use short, easy passwords that anyone could guess.
- A former employee's login still works on a phone nobody remembers.
- Office records can be opened from any network at any hour.
How it works
- The administrator opens the Security app. Sign-ins are logged from day one; every other setting stays off until you switch it on.
- Under Security Settings, set password rules, the lock after wrong tries, session limits, two-factor sign-in and approved devices.
- Add IP rules to allow only the office network or to block addresses. Add sign-in hours per weekday, with holidays.
- To give one Entity its own rules, add it under Settings per Entity. Someone who works in several Entities meets the strictest of them.
- Follow it under Security > Activity: the sign-in log, open sessions, devices waiting for approval, and each login's password age and strength.
Everything it does
Sign-in log
- Every try on the web and in the apps, signed in or refused, with the reason
- How the person signed in: password, passkey, single sign-on or one-time code
- IP address, country and city when known, browser, system and device
- Kept 365 days to start with; passwords are never recorded, not even wrong ones
- A message to the person after a sign-in from a new device, when you switch it on
Passwords and locks
- Minimum length and strength, and the kinds of characters a new password needs
- No reuse of recent passwords, and expiry with a new password asked at sign-in
- Lock after wrong tries for a set number of minutes; an administrator can lift it earlier
- Ask for a New Password: the person chooses one at their next sign-in
- Portal users, such as parents, residents or customers, can be covered too
Two-factor sign-in and devices
- Two-factor sign-in for everyone or for chosen roles, with days to set it up
- A code from an authenticator app, or a passkey: fingerprint, face or security key
- A trusted device skips the code for 30 days to start with
- Approved devices only: a new device waits until a Security Administrator approves it
- Revoke a device and it is signed out at once
Networks, sessions and hours
- IP rules: allow only these addresses or block these, for everyone or chosen roles
- Sessions per login, idle time-out and longest session
- Sign one session out, or sign a person out everywhere
- Sign-in hours per weekday, closed on holidays, read in the Entity's time zone
- A rule that would lock out the person saving it is refused
Who uses it
AdministratorSwitches the rules on and reads the log.
Security AuditorReads the sign-in log, sessions, logins, settings and IP rules.
Security AdministratorChanges settings and IP rules, lifts locks, approves devices and signs sessions out.
Staff memberSets up the second factor where it is asked for, and signs their own other devices out.
Where you use it
- Web: the Security app in the back office
- The SmartMy phone apps: the same checks, with the code, new password and two-factor set-up screens
- The sign-in page: the reason when a sign-in is refused
What you control
Settings
- Security Settings: sign-in log, passwords, IP rules, sessions, two-factor, devices and sign-in hours
- Settings per Entity: one Entity with its own settings, copied from the default
- IP rules and sign-in hours for everyone, chosen roles or one Entity
- Sessions Allowed per user, on the user's Account Security tab
Approvals
- Device approval: a Security Administrator approves or refuses a device that waits
Notifications
- Login locked: to the person and the Security Administrators
- Device waiting for approval: to the Security Administrators, at once
- New sign-in to your account: to the person, when you switch it on
Questions
Is security an add-on?
No. Every security feature is in every plan of SmartMy Trade.Can an administrator see passwords?
No. Only the length and strength of a password when it was set, and its age.Can one branch have stricter rules?
Yes. Give that Entity its own settings. People who work in several Entities meet the strictest of them.Do the phone apps follow the same rules?
Yes. The apps ask for the code, a new password or the two-factor set-up, as the web does.Related features
ACROSS SMARTMY TRADEApproval chainsHeld sales, big purchase orders, write-offs and indents go to the right people in order before they go through. With no set-up the Trade Managers approve; you add levels, such as the owner for credit above an amount, without code.ACROSS SMARTMY TRADENotificationsParties hear when a credit bill is made, a payment comes in, or an order is confirmed or dispatched. They also hear when a bill falls due or a cheque bounces. The owner gets the day's summary each evening. Email and the in-app inbox need no set-up; WhatsApp and SMS use your message credits.ACROSS SMARTMY TRADEDashboardsSmartMy Trade opens on a ready dashboard: sales, what customers owe, supplier bills overdue and shop days not closed. It shows sales by day and your top customers. The owner's phone opens on Today: each shop's sales, collections, dues and low stock.
See your shop on it.
Tell us what you sell, how many shops and godowns you run and how you bill today. We will set up your items and parties with you and print your first bill.