This article covers all security features available in Vemcount — two-factor authentication, browser session management, company-wide password policies, and API key generation. These settings are critical for GDPR compliance and account protection.
Two-factor authentication (2FA)
Path: Avatar (top-right) → User Settings → Security tab
Enable or disable 2FA per user from the Security tab
When active, the tab shows a Show recovery codes button — download and store these. Recovery codes are one-time backup codes used if the 2FA device is lost
Click Disable to turn off 2FA (requires current 2FA code to confirm)
Important: If a user loses their 2FA device and has no recovery codes, an Admin must deactivate and re-create their account. Always encourage users to save their recovery codes when enabling 2FA.
Browser session audit & revoke (GDPR)
Path: Avatar → User Settings → Security tab → Browser sessions
The browser sessions section shows a full audit log of every active login session for the account:
Browser column — full user-agent string including browser name, OS, and version
IP address column — the IP address used for that session
Red trash icon — revoke any individual session immediately
Use this to revoke access if a device is lost or stolen, or to identify unexpected logins from unknown locations as part of GDPR session management.
Company-wide password policy
Path: ⚙ Settings → Companies → [Company] → Employee Settings → Password Policy
Three configuration sections:
Rules
Minimum password length | Set minimum character count |
Must contain letters | Toggle — require at least one letter |
Must contain numbers | Toggle — require at least one number |
Must contain uppercase | Toggle — require at least one uppercase letter |
Must contain special characters | Toggle — require at least one special character (!@#$% etc.) |
Expiration
Enable password expiration | Toggle — forces all users to change password after the set period |
Require admin to reset expired passwords | Toggle — when on, expired-password users cannot self-reset; Admin must do it |
Password expiration period | Number field — days until password expires (e.g. 90) |
Extra security
Allow users to change their own password | Toggle (default ON) — disable to prevent self-service password changes |
Require two-factor authentication | Toggle — enforces company-wide 2FA for ALL users in this company. Users cannot log in without 2FA once enabled |
Password must not have appeared in data leaks | Toggle — checks submitted passwords against known breach databases (Have I Been Pwned). Rejects compromised passwords |
API key generation
Path: Avatar → User Settings → API key tab
Shows the user's personal API key (masked by default)
Click Generate new key to create or rotate the API key
The API key authenticates requests to the Vemcount REST API for external integrations, data exports, and BI tool connections
Security note: Treat your API key like a password. Do not share it or commit it to code repositories. If compromised, generate a new key immediately — the old key is invalidated instantly.
SSO / OAuth (Microsoft Azure)
SSO is configured per white-label brand via the Branding settings. The OAuth section contains a Microsoft Azure toggle — when enabled, users of that brand can sign in via Azure AD / Entra ID instead of username and password. See the White-label branding & feature toggles article for full configuration.
GDPR orphaned user cleanup
Path: ⚙ Settings → Companies → [Company] → Location Management → GDPR
Shows users who have no active locations connected — an orphaned-user cleanup tool for GDPR compliance. Columns: User, ID, Location, Opening Date, Active Date, Closing Date, Deactivate Date, Contract Termination. Use this to identify and deactivate users whose locations have closed, per data-retention obligations.