Security

Enterprise-grade security features.

Features

• JWT authentication with configurable expiration
• Two-factor authentication (TOTP) — optional, or required company-wide
• 140+ granular permissions
• Multi-tenancy data isolation
• OAuth (Google, Microsoft, Apple)
• Sensitive data protection
• Session management

Two-factor authentication (2FA)

FreeMaint supports app-based two-factor authentication (TOTP) with Google Authenticator, Microsoft Authenticator, Authy, 1Password or FreeOTP. It is included on every plan, including the free one — account security is never a paid feature.

Turn it on for your own account

1. Open your profile and find the Two-factor authentication card.
2. Click Enable, then scan the QR code with your authenticator app — or enter the key by hand if you cannot scan.
3. Type the 6-digit code the app shows, and confirm.
4. Save the 10 recovery codes before closing the screen.

Require it across your organization

FreeMaint refuses to enable the policy until you have set up two-factor authentication on your own account, so you cannot lock yourself out first. Companies signing in through SSO are exempt: their identity provider supplies the second factor.

1. Go to Company Settings, then Security.
2. Choose who must use it: Optional, Administrators, or Everyone.
3. Set how many days people have to set it up. During that window they keep signing in normally and see a reminder.
4. Read the list of people affected shown on the page, then save.

Passkeys

A passkey lets you finish a sign-in with your face, your fingerprint or a security key instead of typing a 6-digit code. Your password is still asked first — a passkey replaces the second step, not the first. It is phishing-resistant: unlike a code, it cannot be read out over the phone to somebody pretending to be support.

1. Open your profile and find the Passkeys card.
2. Click Add a passkey, give it a name you will recognise, and follow your device's prompt.
3. If this is your first second factor, save the recovery codes that appear — they are shown once.
4. Next time you sign in, choose Use a passkey instead of typing a code.

Locking the mobile app

On the phone, FreeMaint can ask for your face, your fingerprint or your device passcode before it reopens. This protects a phone handed to a colleague or left on a bench — the session is already on the device either way. It is not a second sign-in: it never reaches our servers, and it never replaces the password you type to approve or sign something.

1. In the mobile app, open Settings and turn on Unlock with Face ID or fingerprint.
2. Choose how long an absence is tolerated before it asks again — immediately, 30 seconds or 5 minutes.
3. Optionally turn on Sealed protection, which encrypts the stored session with your biometrics.

Requiring it across the workspace

An administrator can recommend or require the app lock for everyone, under Company settings, Security. A phone with no screen lock at all is asked to set one and let through, never locked out — and the requirement is applied by the app, not verified by the server, so treat it as a policy you publish rather than a control you can prove.

Signing out after inactivity

An administrator can also close web sessions left idle in a browser tab, after a number of minutes you choose. Off by default. It runs in the browser, so it is a convenience for shared workstations — what actually limits a stolen session is the sign-in token's own expiry.