This article covers the security features in Vemcount: two-factor authentication, browser sessions, company password policy, API keys, single sign-on and the GDPR user clean-up tool. These settings protect your account and help with GDPR compliance.
Two-factor authentication (2FA)
Path: Avatar (top-right) > User Settings > Security tab
Turn 2FA on or off for your user in the Security tab.
When 2FA is on, the tab shows Show recovery codes. Download and keep these codes safe. Each one can be used once if you lose your 2FA device.
Click Disable to turn 2FA off. You need a current 2FA code to confirm.
Important: if a user loses their 2FA device and has no recovery codes, an admin must deactivate and re-create the account. Always save your recovery codes.
Browser sessions
Path: Avatar > User Settings > Security tab > Browser sessions
You see every active login for your account, with the browser and the IP address used. Click the red bin icon to end a session straight away, for example if a device is lost or you see a login you do not recognise.
Company password policy
Path: Settings (cogwheel) > Companies > [Company] > Employee Settings > Password Policy
Rules
Minimum password length.
Must contain letters, numbers, uppercase letters or special characters (each can be turned on separately).
Expiration
Enable password expiration: users must change their password after a set number of days (for example 90).
Require admin to reset expired passwords: users with an expired password cannot reset it themselves.
Extra security
Allow users to change their own password (on by default).
Require two-factor authentication: all users in the company must use 2FA to log in.
Password must not have appeared in data leaks: passwords found in known data breaches are rejected.
API key
Path: Avatar > User Settings > API key tab
Shows your personal API key (hidden by default).
Click Generate new key to create or replace the key.
The key is used to connect to the Vemcount REST API for integrations, data exports and BI tools.
Security note: treat your API key like a password. Do not share it or save it in code. If it may have leaked, generate a new key at once; the old key stops working immediately.
Single sign-on (Microsoft Entra ID)
SSO is set up per partner brand in the Branding settings. The OAuth section has a Microsoft Azure switch. When it is on, users of that brand can sign in with Microsoft Entra ID instead of a password. User accounts are not synchronised from Microsoft; each user must still exist in Vemcount. See How to set up Single Sign-On (Microsoft Entra ID / Office 365).
GDPR user clean-up
Path: Settings (cogwheel) > Companies > [Company] > Location Management > GDPR
Shows users who no longer have any active location. Columns: User, ID, Location, Opening Date, Active Date, Closing Date, Deactivate Date and Contract Termination. Use it to find and deactivate users whose locations have closed.
When to contact support
A user is locked out because of 2FA and has no recovery codes, and your admin cannot help.
You think your account or API key has been misused.
You need SSO activated for your company.
Email support@vemcogroup.com. Never send passwords, recovery codes or API keys by email or chat.