Overview

Two Factor / Multi‑Factor Authentication (2FA / MFA) is available for all users in BrightPay and is now mandatory for team members.

2FA / MFA adds a second layer of protection to re‑confirm the identity of users logging into BrightPay through an internet browser. This improves security, protects against fraud, and lowers the risk of data breaches, as users can access sensitive employer and employee data in BrightPay with an increased security layer.

Enabling and using 2FA / MFA is required for all team members to ensure compliance with our security standards and to better protect your data.

2FA / MFA is mandatory for all Team members on a BrightPay Organisation.

• If 2FA / MFA was not switched on for your Organisation, it will be enabled by the BrightPay Development team.
• In this case, email will be set as the default method for receiving the 6‑digit security code for all affected Team members. (Please check your spam/junk folder if you do not receive it.)
• Once it is enabled on your account (either by you or by our team), it will not be possible to switch it off. This measure is in place to better protect your account and personal data.

2FA / MFA at Organisation level

2FA / MFA is now Mandatory on a BrightPay Organisation, an Owner or an Administrator can view this as follows:

1. Sign into the BrightPay Organisation.
2. Select My Organisation.
3. Select Manage Team Members.

4. You will now see that 2FA is Required

   

Now that 2FA for Team Members option is mandatory, any Team member on the BrightPay Organisation who signs into BrightPay will be required to enter a 6‑digit security code.

If the user has no method of receiving the 6‑digit code set up, by default it will be sent to the team member’s email address. (Please check your spam folder if you do not receive it.)

Note: As team members of organisations now have mandatory 2FA, if that same user goes into the client portal or employee portal using the same Bright ID, the 2FA verification code will be required for those other portals too. A BrightID will require 2FA for all uses with BrightPay and portals once it is enabled.

Enabling 2FA / MFA for an individual Team member

Each Team member can set up the specific method to receive the 6‑digit code for their individual profile. To set this up, the Team member must be logged into BrightPay.

• Select the profile icon in the top right-hand corner and choose Manage my Bright ID.

• Under the Security tab, select 2FA Settings.

• Under Choose your preferred 2FA method, select one of the following:
• Authentication App (preferred and most secure method)
  Use an authentication app that can generate a personal one-time code. Entering the code will be required to successfully log into BrightPay with your Bright ID.
• Text Message
  Receive a text message containing your code to your mobile phone whenever you try to log into BrightPay with your Bright ID. Entering the code will be required to log in successfully.
• Email
  Receive an email containing a code to your email address whenever you try to log into BrightPay with your Bright ID. Entering the code will be required to log in successfully.

Note: To change the 2FA method once set, please select the profile icon in the top right-hand corner and select Manage My Bright ID.

Under the Security tab, select 2FA Settings. Then choose the new 2FA method that you would prefer from the three options available. Save the settings.

FAQs

Q. How do I reset my two-factor / multi‑factor authentication (2FA / MFA) on my Bright ID?

A. For security and GDPR reasons, 2FA / MFA reset requests must come from an authorised contact. Please follow the instructions that match your role:

• Employee
  Please contact your payroll processor or manager and ask them to email our support team to confirm that you would like your 2FA / MFA to be reset.
• Manager
  Please contact your payroll processor and ask them to email our support team to confirm that you would like your 2FA / MFA to be reset.
• Team member / Admin / Payroll Processor
  Please contact your business owner or CEO and ask them to email our support team to confirm that you need your 2FA / MFA to be reset.
• Client portal user (User / Super User)
  Please contact your payroll processor and ask them to email our support team to confirm that you would like your 2FA / MFA to be reset.

Additional security notes

Browser settings will usually remember user login credentials. 2FA / MFA is now mandatory for all Team Members. 

For greater security, BrightPay Cloud supports 2FA / MFA for Employee Self Service Portal users ( it is currently optional). 

To enable 2FA / MFA:

1. Go to Employee Portal > Security Settings.
2. Follow the instructions to activate two-factor / multi‑factor authentication.

This ensures employees cannot access their portal without an additional verification step, even if their browser remembers login sessions.

Note: BrightPay will not automatically log a user out after a period of inactivity on screen.