Set up two-step verification
- Open Preferences from your account menu and go to Security.
- Add a passkey on this device, or set up an authenticator app and save your backup codes.
- If you see the reminder to add extra protection, choose Not now to hide it for seven days on that browser.
Once your authenticator app is on, HollyHR asks for its code, or your passkey, each time you sign in. A passkey on its own is a quick way to verify; it doesn't add a step to every sign-in.
Everyday work
Booking and approving leave, viewing and editing profiles and pay, onboarding and offboarding, running and downloading reports, and uploading or opening documents all use your normal sign-in. HollyHR doesn't ask you to verify again while you work, whether or not you've set up two-step verification.
When HollyHR asks you to confirm it's you
HollyHR checks again just before changes that are hard to undo or that send people's data elsewhere:
- Exporting everything held about a person, the whole organisation's data, or a payroll file.
- Permanently erasing a person, deleting a document or deleting the organisation.
- Viewing or changing bank details.
- Changing someone's access role or transferring ownership.
- Removing someone's access without offboarding them as a leaver.
- Connecting Slack, Microsoft Teams or a payroll app, creating API keys or webhooks, or changing your custom domain.
- Turning off two-step verification or creating new backup codes.
Confirm with your passkey or authenticator code. If you haven't set up two-step verification, some of these changes accept a code sent to your email; others ask you to add a passkey or authenticator first. Either way, what you entered is kept, so you carry on where you left off.