MFA & account security
AfriPhish protects sign-in with two-factor authentication for individuals and a platform security policy that hardens every account at once.
Two-factor authentication (TOTP)
Any user can add a second factor using an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy, and similar).
- Go to Settings → Security / Two-factor authentication.
- Scan the QR code with your authenticator app (or paste the setup key).
- Enter the 6-digit code to confirm, and AfriPhish shows your backup codes.
- Save the backup codes somewhere safe — each is single-use and lets you sign in if you lose your device.
From then on, sign-in asks for your password and then a code from the app. You can use a backup code in place of the app code when needed.
Where MFA applies — the second factor gates password logins and vendor password logins. If your organisation signs in through SSO or Clerk, that provider handles the second factor instead (see below).
Platform security policy
Beyond individual 2FA, the platform enforces an organisation-wide security policy, configured by the vendor in the admin console. It covers:
| Control | What it does |
|---|---|
| Session timeout | Signs idle users out after N minutes (default 30) |
| Login lockout | Locks an account after repeated failed attempts, for a cooldown window (default 15 min) |
| Password policy | Minimum length (default 12) and optional complexity requirement |
| IP allowlist | Restricts access to approved networks when set |
| Enforce MFA | Requires a completed second factor before access is granted |
How "Enforce MFA" behaves
When the policy has Enforce MFA turned on:
- Password / vendor logins must have TOTP set up. Anyone without it is routed to enrol before they can continue.
- Clerk-authenticated customers must have completed MFA in Clerk — the platform checks that the Clerk session satisfies MFA and blocks access otherwise, so the requirement reaches Clerk customers too.
- SSO/SAML and token-refresh flows rely on the identity provider and aren't gated by the platform's own TOTP.
Requires setup — the security policy is managed by the platform vendor (Super Admin console), not per-tenant. If you need specific session, lockout, password, IP, or MFA-enforcement settings for your organisation, request them from your AfriPhish contact.
Next: Branding & org logo.