Account Security

Keeping your account secure is imperative to prevent unauthorised access and exposure to any sensitive data. This article covers tips and functionality to keep your account safe.

Password

Your password is the most critical authentication method of your account. Apart from logging in, your password may be requested to perform specific changes or actions. Please consider the following points regarding passwords:

• Visufund passwords must contain at least one letter, one number and 10 characters.
• Try to use 14 characters or more, upper & lower case letters, numbers and symbols, randomly generated by a password manager.
• If using a memorable password, consider the "Three Random Words" method. (e.g. Smooth21HairyP!ano9).
• Avoid names, words or numbers associated with you personally (eg. pets, date of birth, town/city)
• Never use the same password used by another account.
• Never share your password or login details with other people; create a user account if a team member requires access.
• Our support team will never ask you for your password.
• Change your password if you believe it has been compromised.

Change Password

You can change your password anytime whilst logged in. Performing this action will also log you out of any other devices:

• Navigate to My Account.
• Click Change Password from the submenu OR click the edit button next to Password.
• Enter your Current password.
• Enter a strong New password; retype in Confirm password.
• Click Continue.

2-Step Verification (2SV)

To enhance the security of your account, we recommend setting up an additional authentication method to activate 2SV. Once activated, a one-time passcode must be entered after logging in with your credentials (email/password). There are two delivery methods of one-time passcodes.

Authenticator App

This method is the most secure and requires an authenticator application, typically installed on your mobile device. Examples include: Google/Microsoft Authenticator, 2FAS, Aegis, Authy. To use an authenticator app:

• Navigate to My Account
• Click the Authenticator setup button next to Authenticator App.
• Enter your current password to authenticate.
• Make a note of the backup code and store this in a secure place (e.g. password manager). If you cannot access your authenticator app, this code can be used instead.
• Scan the QR code using your preferred authenticator app. If you are viewing the site on the same device as the app, try using the click this link to perform the registration.
• Ensure that the authenticator app has registered a new entry, displaying Visufund: your@emailaddress.com and the current one-time passcode.
• Click Continue.
• Enter the current one-time passcode.
• Click Continue to complete the setup.

You may need to remove/disable an authenticator app method, particularly if you are changing to a different app or mobile device. To remove this method:

• Navigate to My Account
• Click Remove next to Authenticator App.
• Enter your current one-time passcode from the app or use your backup code.
• Click Continue.

Once removed, you can go through the setup procedure again to re-enable this method.

Email Passcode

This method will email you a one-time passcode when attempting to log in. This method will not be displayed or used if you have the Authenticator app method already enabled. To enable or disable this method, simply click the slider by Email passcode; you may need to enter your password to authenticate this action. Please note that the user email address must be verified before enabling this feature.

Authenticated Sessions

This section in My Account allows you to view a list of IP addresses and all devices/browsers recently used to access your account. If you have:

• Accidentally left yourself logged in to another device which you cannot access, click Log out of other sessions.
• Concerns that someone has unauthorised access to your account, Change your password immediately.

Authentication Requests

To keep your account and data secure, the system may request your password or one-time passcode whilst you are logged in, to perform specific actions or changes. This applies to:

• Adding or removing an authentication method.
• An email address change.
• A user role change.
• Adding or deleting a user account.
• Downloading a report.
• Closing your account.