Account security and audit trail

Vuntus accounts are protected by a password of at least 12 characters. Any user can turn on two-step verification for their own account, and the owner can require it for the whole team. Team management actions always require two-step verification and a session signed in within the last 15 minutes. Decisions such as line decisions, substitutions, unit conversions, quote approvals, imports, invitations and data mode changes are written to the audit trail; records cannot be changed afterwards and are kept for two years.

Account security applies to each user’s own account and opens from Account security in the account menu; it is also in the command menu (Ctrl/⌘+K). The audit trail and Settings › Data & limits are available to the owner and managers only.

Setting up two-step verification

With two-step verification on, you are asked for the 6-digit code from the authenticator app on your phone in addition to your password when you sign in. Team management steps such as invitations, role changes and member actions require it.

1. 01
   Open Account security

   Go to Account security from the account menu. The “Account security” link on the team page leads to the same place.

2. 02
   Confirm your password

   In the Two-step verification section, enter your Current password and select Start setup.

3. 03
   Add it to your authenticator app

   Open an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator, and scan the QR code on screen. If you can’t scan it, choose “enter a setup key” in the app and add the account name and key. Code type: time-based · 6 digits · 30 seconds.

4. 04
   Verify the code

   Enter the 6-digit code from the app in Verification code and select Verify code. If the code is not accepted, check that your phone’s clock is set automatically.

5. 05
   Save your recovery codes

   Recovery codes are shown only at this step. Select Download (.txt), keep the file in your password manager or another safe place, tick I have saved the codes in a safe place. and select Done.

Users cannot turn two-step verification off themselves; there is no button for it in the app. Codes are not sent by text message or email; only an authenticator app is used.

Making it required for the whole team

The owner can turn on Require two-step verification for everyone on the team page. Before it is turned on, the screen lists the people who would lose access. Once it is on, members without two-step verification cannot open company pages and see a setup link instead; their access returns automatically once they set it up. The owner must complete setup on their own account before turning this on.

If you lose your phone

1. Use one of your recovery codes when you sign in. Each code works only once.
2. If you have used most of your codes, go to Account security › Recovery codes › Generate new recovery codes. This requires two-step verification to be on, a session opened in the last 15 minutes and your password; as soon as new codes are generated, all of your old codes stop working.
3. If you no longer have your codes either, contact your company administrator or Vuntus support. The Vuntus setup team creates a one-time recovery link that is valid for one hour; your open sessions are signed out as soon as it is created. You set a new password with the link, and you may need to set up two-step verification again.

Password, sessions and sign-in attempts

• Password: at least 12 characters. When you change it with Change password, sessions on other devices are signed out.
• Session: lasts 8 hours; after that, you sign in again.
• Sign out other sessions under Open sessions signs out every session except this device. Use it for a lost or shared device.
• Failed sign-ins: after 5 failed attempts, sign-in is temporarily locked. The lock starts at 1 minute, doubles with each further failure and lasts at most 15 minutes.
• Forgotten password: there is no self-service reset email. The one-time recovery link described above is used instead.

Audit trail: who changed what, and when?

Audit trail in the sidebar opens the audit trail page. In its own words: “Who did what, and when. Records cannot be changed afterwards.” It is available to the owner and managers.

• Records are append-only; they cannot be edited in the app or in the database.
• Records older than two years are deleted automatically. In a dispute or an official request, Vuntus can place a legal hold that stops the relevant records from being deleted.
• Decisions such as verifying a technical document, setting a unit conversion or substituting a product cannot be completed without a reason, which is why the reason is on record.
• A discount and its reason are frozen inside the approved quote revision; an approved revision never changes afterwards.

Data mode and upload limits

The Settings › Data & limits tab shows which data the company works with, how documents are scanned and the upload limits.

Data in use

Demo data or Real customer data. Every company starts with demo data. Only the owner can enable real data mode, and it needs the legal registration steps to be complete and virus scanning to run on the real engine. Today this mode is locked; the screen says “Real data mode is not open yet: legal registration is being completed.”

Virus scanning

Every uploaded file is virus-scanned before any lines are extracted. A file with a threat is not processed.

Upload limit

Shown read-only. Default: 1,000 uploads in a rolling 30-day period, 2,048 MB of storage and 5 MB per file. This is a technical limit, not a pricing plan; the Vuntus setup team makes any change.

The original of an uploaded document cannot be opened or downloaded in the app today; the document list shows the file name and status.

What Vuntus does not do here

• It does not send password reset, sign-in code or security notification emails.
• It does not let users turn two-step verification off; resetting it is a job for the Vuntus setup team.
• It does not offer a screen to edit or delete audit records.