How your Saudaflow account is protected.
What stands between someone else and your workspace, what you can change yourself in the next two minutes, and — first, because you probably came here for it — what Saudaflow does not have.
The straight answer
There is nothing to switch on. Saudaflow does not have two-factor sign-in for your team yet. No authenticator app, no SMS second step, no recovery codes, no security keys — and no Settings › Security screen.
An older version of this page told you to open that screen, scan a QR code and save ten recovery codes. That instruction was wrong, and it was wrong from the day it was written: the screen has never existed in the product. We have replaced it with this page rather than quietly deleting it, because anyone who followed those steps believed their account had a second factor on it and it did not. If that was you, nothing you did broke anything — but the protection you thought you had turned on was never there. The checklist below is what to do instead.
Six things protect the account, and none of them need turning on.
All of this is enforced by the server for every workspace. There is no setting to miss and no plan that leaves it out.
-
01
Your password is never stored
It is hashed with argon2id — a memory-hard function chosen because it is expensive to attack in bulk. What sits in the database cannot be turned back into your password, by us or by anyone who steals the database.
-
02
Short-lived tokens, rotated on every use
Signing in gives your device a 15-minute access token and a longer-lived refresh token that is replaced every single time it is used. An attacker who copies a token has minutes, not months.
-
03
A stolen token gives itself away
If an old refresh token is presented after it has already been rotated, that is a replay — the session is revoked immediately and the event is written to your audit log as a critical row. There is a 30-second grace window so two browser tabs refreshing at the same instant are not mistaken for theft; a replay outside it is treated as theft, every time.
-
04
Guessing is throttled, and locking out is per-address
Repeated failures lock the e-mail address for fifteen minutes — whether or not that address has an account, so the lockout can never be used to find out who works for you. A successful sign-in never counts against your office's shared internet connection, so thirty telecallers signing in at 09:30 do not lock each other out.
-
05
One account cannot reach another workspace's data
Separation is enforced in the database itself — row-level security, forced on, and deny-by-default: a query that arrives without a workspace context matches nothing, not everything. Inside your workspace, roles decide what each person sees, and field-level masking hides PAN, Aadhaar, bank details, GSTIN and commission values from seats that should not read them. The mask is applied on the server and cannot be reversed by the browser.
-
06
Sign-ins are written down and cannot be edited
Sign-in, failed sign-in, password change, a device signed out, a detected replay — each writes a row into your workspace's audit log, which is append-only: the application has permission to read and insert, and none to update or delete.
Five controls you already have.
Every path below is a real screen in the product. If a step does not match what you see, tell us at support@saudaflow.in and we will fix the page.
See every device signed in as you
Your name, top right › Account & security › Where you're signed in
Each row names the device as best the browser reported it, with the IP it last refreshed from, when the session started and when it was last used. The session you are reading this on is marked This device and has no revoke button — use Sign out for that one.
Sign out a phone you no longer have
Same screen › the device row › Sign out
It takes effect on that device's very next request — not when its 15-minute token expires. The action writes an audit row: "<your name> signed out one of their other devices." No permission is needed: this is your own credential hygiene, and even the narrowest role in the workspace can do it.
Change your password
Same screen › Password
Changing it signs out every other device, which is the point — do it the moment you suspect the password has leaked. The screen says so before the button, not after. The server's minimum is only eight characters with a letter and a number, so the strength of your password is your decision, not a rule we enforce for you. Use a passphrase.
Get back in if you are locked out
Sign-in screen › Forgot password
A single-use link goes to your registered e-mail and expires in thirty minutes. Using it ends every live session on the account, everywhere. There is nothing else to have lost — no recovery codes, no authenticator to re-pair. More at Login issues.
Remove someone who has left
Settings › Employee exits
One action moves their whole open book to the people taking it over and cuts their access: the account is suspended, every live session is killed, and any unused password reset or invite link they were holding is burned. Their suspended status is re-checked on every request, so a token issued a minute earlier stops working immediately. Accrued commission is flagged for review, never silently reassigned.
Watching the account afterwards: open Audit log and filter to the sign-in events. The rows read in plain English — "Priya signed in." · "Failed sign-in attempt for priya@…" · "Refresh-token replay detected — the session was revoked." — and each one carries the actor, the IP, the device string and the exact time in IST.
What Saudaflow does not have, in plain words.
Print this section into a security questionnaire if you like. It is the same answer we will give in the review call.
No second factor for your team
- No authenticator app. Nothing generates a QR code or an otpauth:// URI for a customer account. Google Authenticator, Authy and 1Password have nothing to pair with.
- No SMS second step. A code is never sent as an extra step after a correct password.
- No recovery codes. There are no ten codes to save. If you find a page telling you to save them, it is stale — tell us and we will retire it.
- No security keys, no push approval, no device trust prompt.
- No Settings › Security screen. Your account controls live on Account & security, reached from your name in the top right.
Two things people mistake for it
- Signing in with a phone code is a second door, not a second factor. The design lets someone prove control of the phone on their seat instead of knowing the password — it mints exactly the same session, with the same rotation, the same replay detection and the same audit row. It does not add a step on top of the password. And it is not switched on. Sending an OTP in India needs a registered sender and template with the telecom regulator, and ours is still pending — so the product refuses the request outright rather than minting a code nobody can receive.
- Our staff console's two-factor is not yours. It protects Saudaflow employees signing in to our own internal tools. It is a separate application with separate credentials that no customer ever signs in to. See the next section — we mention it because it is a fair thing to ask about us, not because it protects your seat.
There is no shipped date and no committed one, and we are not going to invent either here — a date on a marketing page is a promise made to someone who cannot chase it. Two things are true and useful instead. The working implementation already exists on our own staff console, so this is a build rather than a research project. And this page will be rewritten the day it is real for your team, because a security page that lags the product is the problem we were fixing when we wrote this one. If two-factor is a hard requirement for your purchase, say so before you spend time on a trial and you will get a yes, a no, or a date — never a "coming soon".
Saudaflow staff cannot sign in without a second factor.
Different application, different credentials, and a customer never touches it. It is worth stating precisely, because "can your people get into my data" is the question behind the two-factor question.
Mandatory, and unskippable
A staff member with no enrolled factor is put straight into setup. No session exists until a factor is confirmed — there is no "remind me later", and no session shape in the code that could represent password-only access.
The strong factor for the strong actions
Sensitive operations demand a fresh password and an authenticator code. E-mail codes and recovery codes are accepted for ordinary sign-in but never satisfy that step-up.
And it still is not standing access
Getting into our console is not getting into your workspace. That needs a reason code, it is time-boxed, and it writes a row into your audit log that nobody here can edit or delete. The whole mechanism is on Security and privacy.
Six habits that do more than a second factor would.
Written for an admin running a sales team, not for a security engineer. Most account losses in this industry are a shared password or a phone that walked, and both are on this list.
- One login per person. Never a shared one. A shared account makes every audit row useless: you can see that a lead was reassigned, but not by whom, and the commission argument that follows has no evidence in it. Seats are how we price, so this is not a trick to sell you more — it is the thing that makes the record worth having.
- Use a passphrase, not a password. Four or five unrelated words beat a short string with a symbol in it, and they survive being typed on a phone in a site office. Our enforced minimum is deliberately low; do better than it.
- Put them in a password manager. Any of them. The point is that nobody has to reuse the password they use everywhere else, which is how most workspace break-ins actually start.
- Remove leavers the same day. Settings › Employee exits does the reassignment and the revocation together, so nobody delays the revocation because the pipeline handover is not ready.
- Review devices once a month. Ask each person to open Account & security and sign out anything they do not recognise. It takes a minute and it catches the lost phone nobody reported.
- Read the audit log after anything odd. A sign-in from an unexpected place, a burst of failed attempts, a replay row — they are all there, in English, with the time in IST.
The ones we actually get asked.
Does Saudaflow support two-factor authentication?
Not for your users. There is no authenticator app, no SMS second step, no recovery codes and no screen offering any of it. Our own internal staff console requires a second factor for our people, but that is a different application and it is not connected to customer sign-in.
What you have today: unique passwords, sign-in throttling that counts failures, fifteen-minute access tokens with rotating refresh and theft detection, a device list you can revoke from, an offboarding flow that revokes a leaver in one action, and a sign-in record in the audit log.
This page used to say "Turn on 2FA in Settings › Security". Where is that screen?
It does not exist and it never did. Your own account controls are on Account & security, reached from your name in the top right: your profile, the appearance setting, your password, and every device holding a live session. There is no two-factor control on it because there is no two-factor.
My phone was stolen. What do I do right now?
Two things, in this order. Open Account & security on any other device and sign the phone out from Where you're signed in — it stops working on its very next request. Then change your password on the same screen, which signs out every other device as well and burns anything the thief might already have copied.
If you cannot get in at all, use Forgot password on the sign-in screen: the reset ends every live session on the account, everywhere, including the phone.
Someone left the company yesterday. Is their access gone?
Only once you run Employee exits from Settings — it is one action and it does the whole thing: their open leads, deals and visits move to the people taking over, the account is suspended, every live session is killed, and unused reset or invite links are burned. Suspension is re-checked on every request, so an access token issued a minute before stops working immediately rather than lasting out its fifteen minutes.
One thing it deliberately does not do: reassign accrued commission. That is flagged for a human to settle, because moving money owed to someone as a side effect of a personnel change is not a decision software should make.
Is signing in with an OTP the same as two-factor?
No. It is an alternative way to prove who you are instead of the password, not an extra step on top of it. It mints exactly the same session with the same rotation, the same replay detection and the same audit trail — the only difference is what was proved.
It is also not switched on. Sending an OTP in India requires the sender name and the message template to be registered with the telecom regulator, and ours is still pending. Until then the product refuses the request outright rather than pretending to send a code.
Can I force everyone in my workspace to use strong passwords?
Not with a setting, no. The server enforces one rule for everyone — at least eight characters, with a letter and a number — and there is no per-workspace password policy, no expiry, no history and no complexity switch. We would rather say that plainly than let you believe a policy is being enforced that is not.
What you can do is check: the audit log shows who has changed their password and when, and Account & security shows each person their own live sessions.
When will two-factor ship?
We have not committed to a date, and we are not going to invent one here — a date on a marketing page is a promise made to someone who cannot chase it. What we can tell you: the working implementation already exists on our own staff console, so this is a build rather than a research project, and this page will be rewritten the day it is real for your team. If it decides your purchase, ask support@saudaflow.in and you will get a straight answer with a date attached to it, or an honest no.
Related help
Still stuck? support@saudaflow.in — a person answers, 09:30–19:00 IST, every day.