Configure password policies, multi-factor authentication, session controls, IP allowlisting, and login lockout to protect your HR data.
Coming soon. This feature isn't available in Octal HR yet — this guide is published ahead of release. For what’s available today, see the Help Center or contact us.
Where to Find Security Settings
Go to Settings → Security. Only System Admin role can modify security settings. Changes apply to all users in your tenant immediately.
Password Policy
Password Requirements
Minimum Length8 characters (recommended: 12+)
Uppercase Letters● Required
Numbers● Required
Special Characters○ Optional (enable for higher security)
Breach CheckBlocks passwords found in known data breach lists (HaveIBeenPwned)
Current Policy Strength
Moderate
Enable special characters and reduce expiry to 60 days to reach Strong.
Recommended for HR systems: Minimum 12 characters, uppercase + number + special character, 60-day expiry, and block breached passwords. Payroll data is high-value and warrants a stricter policy than most business apps.
Multi-Factor Authentication (MFA)
MFA adds a second verification step after password login, dramatically reducing the risk of account takeover even if a password is compromised.
Authenticator App
Google Authenticator, Authy, Microsoft Authenticator — TOTP codes. Most secure option.
SMS OTP
One-time code via SMS to registered phone. Works with local Pakistan numbers (Jazz, Ufone, Zong, Telenor).
Email OTP
One-time code sent to the user's registered email. Lower security than TOTP but no phone number needed.
MFA Configuration
MFA EnforcementOff / Required for Admins / Required for All
Allowed MethodsTOTP App, SMS OTP, Email OTP (tick to enable)
Grace Period (new users)7 days to enroll before MFA is enforced
Remember Device30 days (trusted browser skip MFA)
Admin MFA ResetAdmins can reset a user's MFA if they lose their device
Recommended: Enable MFA as Required for Admins at minimum. HR Admin and Finance users have access to salary data, which makes them high-value targets for phishing attacks.
Setting Up MFA as a User
1
Click your avatar in the top-right → Profile & Security.
2
Under Two-Factor Authentication, click Enable.
3
Choose your method: scan the QR code with your authenticator app, or enter your phone number for SMS.
4
Enter the 6-digit code to confirm setup.
5
Save the backup recovery codes shown — print or store securely. These allow access if you lose your device.
Maximum Session Duration8 hours (absolute, regardless of activity)
Concurrent SessionsAllowed (configurable to 1 session only for Admins)
Remember Me7 days (can be disabled entirely)
Force Logout All UsersAdmin emergency action — invalidates all active sessions instantly
Admins can view all active sessions for a specific user under Settings → Users → [User] → Active Sessions and terminate any session individually.
Login Attempt Lockout
Protect against brute-force password attacks with progressive lockout:
Failed Attempts
Action
How to Unlock
3 attempts
CAPTCHA challenge shown
Solve CAPTCHA
5 attempts
Account locked for 5 minutes
Wait 5 minutes or admin unlock
10 attempts
Account locked for 1 hour
Wait 1 hour or admin unlock
15 attempts
Account suspended — admin must unlock
Admin: Settings → Users → Unlock
Admins can adjust the lockout thresholds or disable lockout (not recommended). An email alert is sent to the System Admin when any account is suspended due to failed attempts.
IP Allowlisting
Restrict logins to specific IP addresses or CIDR ranges — useful for office networks or VPN requirements.
IP Access Control
Add one or more IP addresses or CIDR ranges. Users attempting to log in from unlisted IPs will be blocked. Employee self-service portal can have a separate (less restrictive) allowlist from the admin portal.
203.128.12.0/24 ← Lahore HO range
192.168.1.0/24 ← LAN (office internal)
203.99.45.12 ← VPN exit node
Caution: Before enabling IP allowlisting, add your current IP to the list. If you lock yourself out, contact Octal HR Support — emergency access requires identity verification and takes up to 1 business day.
SSO & Password Policy Interaction
If you've configured , the password policy for SSO users is enforced by your Identity Provider (Google Workspace, Microsoft Entra ID, etc.), not by Octal HR. However:
MFA configured in your IdP is honoured — users don't see an additional Octal HR MFA prompt.
Session timeout is still controlled by Octal HR settings.
You can enable SSO-only mode to prevent users from logging in with an Octal HR password directly — all logins must go through your IdP.
Security Alerts & Audit Events
The following security events are logged in the Audit Log and can trigger email alerts to the System Admin:
Event
Default Alert
Admin login from new IP
● On
Account suspended (lockout)
● On
MFA disabled for a user
● On
Role elevated to Admin
● On
Bulk data export initiated
● On
API key created
○ Off (enable recommended)
Payroll run approved
○ Off
Configure security alert emails under Settings → Security → Alert Recipients. You can add multiple email addresses — useful for notifying both the IT team and HR management of critical events.