Collection data deserves careful handling. CollectPlus 12 adds a second step at sign-in and makes it simpler to control who can get in.
Two-factor sign-in
- A code at sign-in. After the password, the web app sends a one-time code by email, or by text message to debtors whose phone is set up for texts.
- Remember this device. People can mark a device as trusted, so they are not asked for a code every time. By default a device is remembered for 30 days.
- Recorded in the security log. Two-factor events are logged, along with password changes and resets and accounts that are locked or unlocked.
Account controls
- Disable a user once. One switch refuses a staff user on the Windows application, the web app and the web services API. Access can also be turned off for just one of them.
- Password rules and lockout. Set the rules your agency needs, lock accounts after failed attempts, and make people change a temporary password the first time they sign in.
- API tokens that expire. Tokens for the web services API expire after 24 hours unless you choose another limit, and failed API sign-ins are logged.
Who changed what
- Settings audit. Every settings change is recorded with who made it, when, and the old and new values. It is recorded in the database, so a change made from any application is caught.
- Report runs. Each report run from the web app is logged with the user and the criteria used.
- Field-level permissions. Decide who may see sensitive fields such as Social Security and account numbers, which can also be encrypted in the database.
Two-factor sign-in applies to the web app and is switched on by your administrator. More about security in CollectPlus.