Signing in securely

Vendorica holds your contracts, your findings and your regulatory filings. The account protecting all of that is worth ten minutes.

Single sign-on, enforced two-factor, role-based permissions and session controls — with every access event recorded in the audit trail.

Turn on two-factor authentication

Your own security settings live under your avatar, in Account → Security.

1. Choose Enable two-factor authentication. Vendorica shows a QR code and, next to it, a manual entry key for authenticator apps that cannot scan.

2. Scan it with your authenticator app. Any TOTP app works — the one your organization already standardises on is the right choice.

3. Enter the six-digit code the app shows, to prove the pairing worked.

4. Store the recovery codes. They are shown once. Put them where you keep other break-glass credentials — a password manager, not a note on your desktop.

Recovery codes are the whole point

A lost phone with codes stored is a two-minute inconvenience. A lost phone without them means an administrator has to reset your second factor, and if you are the only administrator, it means contacting us. Regenerate them from the same screen whenever you use one.

If your organization requires it

An administrator can require two-factor for everyone in Settings → Security. When that is on, anyone without it is walked through the enrolment above at their next sign-in — scan, verify, store recovery codes — before they can reach anything else.

The org-wide switches

Settings → Security carries the controls that apply to every member:

• Require two-factor authentication — the switch above.
• Allow magic-link login — whether a signed link by email is accepted as a way in.
• Bind sessions to device — a session stops working if it is replayed somewhere else.
• Session idle timeout — how long an unused session survives.

Turn these up deliberately, not defensively. A ten-minute idle timeout that signs people out mid-review teaches them to hate the product, and it does not make anything meaningfully safer.

Single sign-on

Settings → SSO configures SAML 2.0 identity providers, and SCIM 2.0 for outbound provisioning so accounts are created and deactivated from your directory rather than by hand. There is a test SAML login on the same page — use it before you switch anyone over, because a misconfigured identity provider locks out everybody at once.

Who did what

Every sign-in, permission change and access event is recorded in the Audit Trail (in the sidebar, near the bottom). It is append-only and hash-chained, so it answers the auditor’s question — who saw this, and when — without anyone having to remember.

Related

• Roles and permissions — what a signed-in person can then do.
• Inviting your team — getting them in in the first place.